Implement secure login in Codeigniter test with Wireshark

Question

Today I try to test my website which build with codeigniter. I try to check that using Wireshark (for network administrator). But in traffic, I still see the username and password login. So maybe any ideas to solve this problem. maybe someone else have this problem too.

Here is my controller

 public function val()
  {
      $this->form();    
      if($this->form_validation->run()==FALSE)
      {
        $this->load->view('form_login_val');
      }else
      {
       $username = $this->input->post('username');
       $password = $this->input->post('password');

       $cek = $this->m_login->takevalidator($username, $password );
       if($cek <> 0)
            {
              $this->session->set_userdata('validator_status', TRUE);                                  
              redirect('home/validate');
            }
        else
            {
             $this->session->set_flashdata('gagal_login', "Username atau password yang anda masukkan salah.");  
             redirect('reff/val');        
            }
      }  
  }

Thanks

Could you please post some more details? – Hatchet Jan 16 '16 at 01:49 — Hatchet, Jan 16 '16 at 01:49

score 3 · Answer 1 · answered Jan 16 '16 at 01:55

3

As has been mentioned in the comments, if you don't want these fields to be sent unencrypted, you must use HTTPS/SSL; on an unencrypted connection, POST is no more secure than GET.

For more details, see this question: How secure is a HTTP POST?

answered Jan 16 '16 at 01:55

Hatchet

4,880
1
29
42

can I use alternative another using SSL? – Chris Jan 16 '16 at 01:58
Finding an alternative to SSL is another topic for another question. If you feel you can't find a solution, feel free to post another question. – Hatchet Jan 16 '16 at 02:01
1

@Fatchul No, if this is a concern for you SSL is the fix. – ceejayoz Jan 16 '16 at 02:18
1

@Fatchul No, the core of the *solution* is SSL. The core of the problem is you're using plain HTTP to send sensitive data currently. – ceejayoz Jan 17 '16 at 14:10
By SSL, they mean TLS 1.0+ (preferably 1.2) with perfect forward secrecy. :] – Scott Arciszewski Jan 17 '16 at 20:35

Implement secure login in Codeigniter test with Wireshark

1 Answers1