Skip to content

Credentials for login are passed over HTTP even if HTTPS is enabled #676

@ShubhamGupta29

Description

@ShubhamGupta29

There is a login feature available for AutoTuning purpose. The issue is that if user reaches this Login page from the non-secure endpoints of Dr.Elephant or referred by some third-party(like Azkaban) via non-secure Dr.Elephant link/URL then the Login page will also be non-secured and forwarding of the login credentials to the backend is a security risk.

Internal Issue Tracking: PWN-19630

Metadata

Metadata

Labels

securityAny issue related to security of the user or service

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions