Prompts not properly masked
- Dominant language
- TypeScript
- Stars
- 40k
- Forks
- 2.4k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 61
Description
### Expected Behavior
"Password" prompts (those defined with the "Mask Text" checked) should not echo actual characters, but rather hide them (*****).
This has been broken for a while (6 months maybe?).
### Actual Behavior
I can see the password I enter.
### Reproduction Steps
The prompt is defined in the **Body** area...
... as a **_Prompt**...
... but when I **Send** the request I can see what I type
### Is there an existing issue for this?
- [x] I have searched the [issue tracker](https://www.github.com/Kong/insomnia/issues) for this problem.
### Which sync method do you use?
- [ ] Git sync.
- [ ] Insomnia Cloud sync.
- [ ] Local only
### Additional Information
_No response_
### Insomnia Version
13.0.2
### What operating system are you using?
Windows
### Operating System Version
Windows 11
### Installation method
downloaded from Insomnia.rest and auto-updated many times since
### Last Known Working Insomnia version
not sure
Contributor guide
Research direction
Reproduce the issue using a masked Password prompt in the request Body area and confirm that entered characters are visible after sending. Trace the prompt handling from the Body prompt configuration to the send flow; done means masked prompts display hidden characters rather than the actual password.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- electron, typescript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 50/100