Forum Discussion
Zuke
Cirrostratus
CirrostratusHide Username and Password in URL
We have a video streaming app that has a basic username/password authentication. Accessing the application is done by going to rtsp://username:password@example.com:554/video Infosec isn'...
Hamish
Cirrocumulus
CirrocumulusI don't blame them. Username and password in the URL is a pretty basic security mistake. e.g. when you're passing via a proxy. After all the URL is going too be logged somewhere... In your history etc.
The only way you can mask it is by changing the application that's insecure enough to insist on user/pass in the URL for a decent one.
ZukeThat's the conclusion I came to as well.
