GWT RPC: Is it secure to send plain-text password

Question

I have a question about how to send password over the wire from the GWT web app to the server.

My client talks to server using HTTPS. My understanding is that GWT RPC uses HTTP POST to communicate. So I assume it is OK to send plain-text password using GWT RPC.

Am I wrong? Is there any other options for sending password securely between GWT client and server?

Many thanks

score 2 · Answer 1 · edited May 23 '17 at 12:21

There will be no problem because you are laready using HTTPS.

If still you have a narrow edge in mind then you can send the strings like passwords..account numbers in a secured way by using a thirdparty light weight library called GWT-Crypto.

It uses TripleDesCipher to encrypt your strings with an byte array key(known by you only).

Here is an example ,and not exactly but some related question here.

score 1 · Answer 2 · answered Mar 20 '13 at 22:10

1

GWT is not different to any other browser app. Almost authentication systems use the same approach: send password using POST over HTTPS.

answered Mar 20 '13 at 22:10

Manolo Carrasco Moñino

9,723
1
22
27

score 1 · Answer 3 · edited May 23 '17 at 10:32

1

You are right that it is OK to send plain-text password using GWT RPC This might help 1) GWT/Javascript client side password encryption 2) GWT with SSL security

edited May 23 '17 at 10:32

Community

1
1

answered Mar 21 '13 at 06:21

Vikash Rajpurohit

1,525
2
13
13

GWT RPC: Is it secure to send plain-text password

3 Answers3