User credentials exposed on request payload. about brmodelo-app HOT 2 CLOSED

@Victor-Manoel-Public good catch! Thank you...

I will fix this tonight!

Would you mind give us a star to help us to get more support? It's all by our own

Thank you again mate

from brmodelo-app.

Hey, thank you for the response!

I didn't get to see the source code but from what I saw in your last 5 commits, I believe that the server shouldn't return any credential, just some code that represents the status code with some generic error.
In the case of login, when the password or email is wrong, just return the error of invalid credential and the http code 401 inside an object, for example:
{
"status_code":401,
"message": "Email ou senha inválido(s).",
"error": true
}
Upon successful login, just redirect to home without any return.

These are just guesses that I believe bring more security.

from brmodelo-app.