Plain text password is logged at DEBUG level when FORM-based authentication is used in JBoss EAP 6.4

Solution Unverified - Updated -

Issue

  • When a FORM-based authentication is used, plain text password can be seen in a server.log when DEBUG level logging is active.
    Steps to Reproduce:
  1. Create application with FORM-based authentication.
  2. Set logging level to DEBUG in standalone.xml and start the server.
  3. Deploy application and log in
  4. Search for "&j_password=" in server.log file.
DEBUG [org.apache.coyote.http11] (ajp-/127.0.0.1:8009-51) JBWEB003028: Start processing with input [USERID=User1&PASSWORD=User12@]

Environment

  • Red Hat JBoss Enterprise Application Platform (EAP)
    • 6.4.0

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content