Plain text password is logged at DEBUG level when FORM-based authentication is used in JBoss EAP 6.4

Solution Unverified - Updated -

Issue

  • When a FORM-based authentication is used, plain text password can be seen in a server.log when DEBUG level logging is active.
    Steps to Reproduce:
  1. Create application with FORM-based authentication.
  2. Set logging level to DEBUG in standalone.xml and start the server.
  3. Deploy application and log in
  4. Search for "&j_password=" in server.log file.
DEBUG [org.apache.coyote.http11] (ajp-/127.0.0.1:8009-51) JBWEB003028: Start processing with input [USERID=User1&PASSWORD=User12@]

Environment

  • Red Hat JBoss Enterprise Application Platform (EAP)
    • 6.4.0

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.

Current Customers and Partners

Log in for full access

Log In
Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.