CODEWITHSUNDEEP
c#asp.netjsonhttpwebrequest
Computer
Computer

Reputation: 2227

How to encrypt username/password for session

I am making a call to a 3rd party service via https (using HttpWebRequest and sending a username, password in order to return a token which is then needed to make future requests for data). The service would only be required to list items on a public ASPNet website.

There will be no database involved so session or cookies would be storing the token.

To get the token I send a POST request which includes the username/password but I can see these details (username/password) in Fiddler (headers text tab I think but can confirm if anyone asks) - personally I thought I shouldn't? When I make a GET request to get the items I send the token and all works.

So am I supposed to encrypt the username/password somehow before making retrieving the token? If yes how would I do that?

I just feel that anyone could check the POST request and see what's going on. I could be wrong but happy to test any theories.

Edit 1

Here is the code i am sending the POST request. Please note the username and password along with the URL which is https

    private string UsernamePassword()
    {
        string un = new JavaScriptSerializer().Serialize(new
        {
            User = "abc",
            Password = "123"
        });

        return un;
    }

        HttpWebRequest wr = (HttpWebRequest)WebRequest.Create("https://site.data.com");

        wr.Headers.Add(HttpRequestHeader.AcceptEncoding, "gzip, deflate, br");
        wr.Headers.Add(HttpRequestHeader.AcceptLanguage, "en-GB,en-US;q=0.9,en;q=0.8");
        wr.Headers.Add("Sec-Fetch-Site", "same-origin");
        wr.Headers.Add("Sec-Fetch-Mode", "cors");

        wr.Accept = "application/json";
        wr.ContentType = "application/json";

        byte[] data = null;

        wr.Method = "POST";
        data = Encoding.UTF8.GetBytes(UsernamePassword());
        wr.ContentLength = data.Length;
        wr.KeepAlive = true;          
        wr.AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate;

        try
        {
            using (Stream stream = wr.GetRequestStream())
            {
                stream.Write(data, 0, data.Length);
                stream.Flush();
                stream.Close();
            }

            using (HttpWebResponse httpResponse = (HttpWebResponse)wr.GetResponse())
            {
                var encoding = Encoding.GetEncoding(httpResponse.CharacterSet);

Upvotes: 0

Views: 432

Answers (1)

devb
devb

Reputation: 279

@germi is right. That's exactly what TLS/Https is for. The fact that you can see the content of your https request doesn't mean anyone can.

As long as your endpoint is using https (and not http), the exchange will happen over an encrypted channel. If you want to verify, install Wireshark and see for yourself.

Upvotes: 3

Related Questions