Today I noticed something strange while building a website. I opened "Dev-Tools" in Firefox and after entering my Email/Password, I actually found them exposed in the "Network" Tab in "Dev-Tools". Is this behavior normal? I found the same thing when I logged in into my Github and Google Account. I am not very experienced in Web Development, but regardless I found this to be strange. I am certain that I am not the first one to notice this, but I just want to know why is this allowed. Thanks in advance for clarifying.
Vulnerability: Password Exposed
47 Views Asked by Aymen At
1
There are 1 best solutions below
Related Questions in SECURITY
- HTTPS configuration in Spring Boot, server returning timeout
- HSM ZKA control mask values
- OWASP Amass Subcommands
- Is there a need for BPF Linux namespace?
- Error when trying to execute a binary compiled in a Kali Linux machine on an Ubuntu system
- When sanitize/encode while implementing tags system like on SO
- spring security version in spring-boot-starter-security
- I am currently trying to implement a rudimentary firewall from a video I watched but the nimda worm detection is not working and i do not know why?
- Is it possible for `sudo` to fail temporarily with the correct password? Hacking suspected
- Is it viable proxying all my mobile apps requests, to some kind knowing that a request is coming from a secure source
- What abilities should I concentrate on while bug hunting, and how can I improve the quality of my bug bounty reports?
- System.ArgumentOutOfRangeException: I passed this error in every single program
- How to prevent users from creating custom client apps?
- Does server-side content security policy exist for youtube video player API, app, mod apks and website?
- Can we pass a hostname/IP address as a query string in a GET request in REST API
Related Questions in WEB
- Settlement Amount of Razorpay Dashboard is not correct
- How can I implement synchronous registration on a website and a forum by linking their databases?
- NextJS 13+ how to use parallel + intercepting routes to create a modal on a page which also stores/syncs state with search params?
- logo image error nextjs notion starter kit with teamspace
- how do i create slider on Wix website builder?
- Why do I get 500 error on Azure after using ViewBag?
- After pg-related pop-up calls and processing, the web application JSESSION is broken
- How can i upload image on Laravel React App
- React Routing in web development using an index template
- Why is my time filter not updating within my Quasar template?
- Why do I have a 403 error when trying to save a website
- Hadoop MiniCluster Web UI
- How to debug flutter web app to check maximum memory consumption issue?
- How to send a HTTP Cookie using the Set-Cookie header over a HTTP connection?
- Is it posible to modify packets that creats by request python module?
Related Questions in PASSWORDS
- Forgotten RAR password recovery
- I'm unable to access 'https://github.com/Danniecodjoe/alx-system_engineering-devops.git/':
- How to get new text input after entering a password in a tab?
- invalid application password of gmail
- Auto-complete doesn't work on Chrome or Edge
- Decrypting Magento 2 customer passwords using email for migration to Shopify
- In two subversion repositories (same machine), can I have different usernames with no password prompting?
- Store website username/password on Elinks for Ubuntu
- Sending Password to a PHP Script
- "error": "The public key is required. Visit https://dashboard.emailjs.com/admin/account"
- im stuck trying to guess a password to a server im accessing through netcat for a ctf
- Hashcat / John the Ripper - find password when you know most of password but don't remember the sequence
- Hashing the password if it is not hashed in django
- How do I change I change my redis docker containers password?
- How to detect password protected file in Angular 14+ without using Promise calls
Related Questions in FIREFOX-DEVELOPER-TOOLS
- In my range slider the track is coming over on thumb while working fine on Chrome
- Facing the error: "binary is not a Firefox executable" when using Selenium with Firefox WebDriver
- How to break on a *later* subtree modification in DevTools on github.com
- Is there any way to save in PDF automatically the website with window.print() or Ctrl+P in Firefox?
- Firefox developer tools Inspector advanced preferences
- Firefox devtools not showing request details
- Why does Firefox delete part of my CSS selector despite that it actually matches something in the HTML when testing it in the web inspector?
- Restore font size on Firefox developer tool
- Vulnerability: Password Exposed
- Can I show the responses to all the requests at once in the Firefox Network Monitor?
- How to locate the js statement that jumps to another web page?
- Identifying the domains implemented in Firefox RDP which is subset of the Chrome DevTools Protocol (CDP)
- How to force Chrome to use HTTP/1.1 for a particular Website?
- How to intercept an eventhandler in javascript?
- Creating a tab from inside a devtools extension returns successfully with a tab id of -1
Trending Questions
- UIImageView Frame Doesn't Reflect Constraints
- Is it possible to use adb commands to click on a view by finding its ID?
- How to create a new web character symbol recognizable by html/javascript?
- Why isn't my CSS3 animation smooth in Google Chrome (but very smooth on other browsers)?
- Heap Gives Page Fault
- Connect ffmpeg to Visual Studio 2008
- Both Object- and ValueAnimator jumps when Duration is set above API LvL 24
- How to avoid default initialization of objects in std::vector?
- second argument of the command line arguments in a format other than char** argv or char* argv[]
- How to improve efficiency of algorithm which generates next lexicographic permutation?
- Navigating to the another actvity app getting crash in android
- How to read the particular message format in android and store in sqlite database?
- Resetting inventory status after order is cancelled
- Efficiently compute powers of X in SSE/AVX
- Insert into an external database using ajax and php : POST 500 (Internal Server Error)
Popular Questions
- How do I undo the most recent local commits in Git?
- How can I remove a specific item from an array in JavaScript?
- How do I delete a Git branch locally and remotely?
- Find all files containing a specific text (string) on Linux?
- How do I revert a Git repository to a previous commit?
- How do I create an HTML button that acts like a link?
- How do I check out a remote Git branch?
- How do I force "git pull" to overwrite local files?
- How do I list all files of a directory?
- How to check whether a string contains a substring in JavaScript?
- How do I redirect to another webpage?
- How can I iterate over rows in a Pandas DataFrame?
- How do I convert a String to an int in Java?
- Does Python have a string 'contains' substring method?
- How do I check if a string contains a specific word?
What you see in the DevTools is the local, unencrypted data. The encryption of the data happens later in the network request stack. The same is true for network responses. Their data is decrypted first and then the DevTools display the data.
This is to allow debugging the data on the client side.
So, any data sent over the network is still TLS encrypted when accessing a website which is using HTTP. And there is no security issue in the DevTools displaying passwords or any other raw data.