PasswordField should not contain real password
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.8k
- Forks
- 717
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 3
Description
This behavior is working as described in the documentation:
Unless the server connection is encrypted with a secure connection, such as HTTPS, the input is transmitted in clear text and may be intercepted by anyone with low-level access to the network.
I think it would be good practice to not reveal the actual password to the browser. The PasswordField should handle this transparently.
This was observed with Vaadin 8.2.1, but since it is working as documented, every version will be affected.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked PasswordField documentation and reproduce the behavior described for Vaadin 8.2.1. Then inspect the PasswordField handling to determine whether the requested protection is technically and transparently feasible. Done requires an agreed design for avoiding clear-text exposure and a documented way to verify the behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100