Credentials for login are passed over HTTP even if HTTPS is enabled
ShubhamGupta29 opened this issue · 0 comments
ShubhamGupta29 commented
There is a login feature available for AutoTuning purpose. The issue is that if user reaches this Login page from the non-secure endpoints of Dr.Elephant or referred by some third-party(like Azkaban) via non-secure Dr.Elephant link/URL then the Login page will also be non-secured and forwarding of the login credentials to the backend is a security risk.
Internal Issue Tracking: PWN-19630