How to secure the login API

Showing results for 
Search instead for 
Did you mean: 
Established Member

How to secure the login API

Hi All,

During the security test of our instance our security expert asked us to secure the login API

as it send the username and password as it is and can be used by attacker to forge the request login if the admin password is known.

Can anyone tell me how we can secure this API or in my case I can disable it also.


Hiten Rastogi

1 Reply

Re: How to secure the login API

Configure your system to use HTTPS / SSL only, and use a proxy / gateway to disallow the use of the GET-based login operation. The POST-based login operation (same URL, only using JSON post body instead of URL parameters) should be the only one allowed to avoid username / password to appear in any access logs.