0

To make the Drupal login as secure as possible, we don't want to send the login credentials as clear text, but want to somehow encrypt the credentials or the entire request.

Ideally the solution should both for the actual login page, but also if the user logs in via the login block on any page.

6
  • Sounds like you are doing it wrong. You should explain what you are trying to achieve, what you have tried and why you want to do this. – googletorp Oct 17 '16 at 12:40
  • Drupal 7 is encrypt submissions, or encrypt password module using salt hashing.This will display the encrypted password via tamper data in browser not display the plain text using post method. Now i am also searching about this type of modules are available there in drupal 8 using salted hashing. – pandiarajan R Oct 18 '16 at 4:48
  • We don't understand your question and the comment didn't help. I gather that English isn't your native language, but your question and comments needs higher quality to be understandable. – googletorp Oct 18 '16 at 8:34
  • On using Tamper data tool on checking the post parameter value of user login it passes the plain text but i want to encrypt password of plain text to salt hash to secure my user login. I used the secure login with SSL but i also need the encrypt need for passing parameter – pandiarajan R Oct 18 '16 at 9:10
  • So the question is how to force https for user login? – googletorp Oct 18 '16 at 10:22
1

You can't really do that.

Drupal 8 hashes and salts the password on the server side.Both the form and the authentication API require the plain password which is then validated. You should use HTTPS to protect the password during submission.

To be able to do something like this, you'd either need to use encryption, so you can decrypt again on the server or bypass the API somehow, but that isn't really possible since Drupal's hashing implementation has a dynamic salt and each hash has its own salt that you do not know in JS. Also keep in mind that anyone can read/debug the JS and figure out your salt or encryption key if you have it in JS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.