How to secure the login API

cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Established Member

How to secure the login API

Hi All,

During the security test of our instance our security expert asked us to secure the login API 

http://www.myserver.com:8080/alfresco/service/api/login?u=me&pw=mypassword

as it send the username and password as it is and can be used by attacker to forge the request login if the admin password is known.

Can anyone tell me how we can secure this API or in my case I can disable it also.

Thanks

Hiten Rastogi

1 Reply
Highlighted
Master

Re: How to secure the login API

Configure your system to use HTTPS / SSL only, and use a proxy / gateway to disallow the use of the GET-based login operation. The POST-based login operation (same URL, only using JSON post body instead of URL parameters) should be the only one allowed to avoid username / password to appear in any access logs.