Does it possible to encrypt the user credentials over the browser ?

Solution Verified - Updated -

Environment

  • Red Hat Single Sign On(RHSSO)
    • 7.x
  • Red Hat Build of Keycloak(RHBK)
    • 22.x
    • 24.x

Issue

  • During user authentication username & password are sent plain text from
    browser to back-end.
  • Is it possible to encrypt password before transmission to browser ?
  • While the transfer of data is encrypted using HTTPS, there is a concerns regarding the security of sensitive
    information (password) being exposed.
  • Password is not encrypted when passing to the Keycloak server.

Resolution

There is no way to encrypt password before transmission. Password encryption before transmission is not defined in any RFC regarding HTTP.

Basically the network tab does not store anything. It's literally showing the data that you are sending out over the network. The network connection to Google is secured with HTTPS, so anyone sniffing on the network will only see encrypted data.

The data transfer is encrypted when the HTTPS enabled, in the browser (what you see in the network tab it is of course not (yet) encrypted.

For any encryption you would need a way to securely exchange encryption keys, and that is where do not gain over using TLS.

Browser developer tools does not capture information unless the tool is open, and it only stores it for a short while; There are two scenarios this could be problematic:

  1. User opens login pages, or other pages with sensitive information, with developer tools open. Then leaves the computer unlocked allowing an attacker to access these. Although, at this point an attacker could get all sorts of interesting things anyways.

  2. User records a HAR export of the network traffic and shares this with other people. someone will sometimes ask for an HAR to analyze an issue, but this is not something you should ever do as HAR includes everything, including cookies, in plain-text

For point 1 that's about awareness for users; For point 2 same thing and if you really need to share HAR files, then they need to be carefully sanitized by the user before sending.

If you need more security, enforce multi factor or mutual authentication.

Root Cause

  • To encrypt passwords over the network there is no other way rather enabling HTTPS/TLS. HTTPS for communication between the Keycloak auth server and the clients Keycloak secures to prevent man-in-the-middle attacks.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments