# A security related question

**URL:** <https://www.ruby-forum.com/t/a-security-related-question/175823>\
**Category:** Rails\
**Created:** [September 20, 2009, 10:46pm UTC](https://www.ruby-forum.com/t/a-security-related-question/175823 "2009-09-20T22:46:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![comopasta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/59ef9b/32.png) [@comopasta](https://www.ruby-forum.com/u/comopasta)\
**Post date:** [September 20, 2009, 10:46pm UTC](https://www.ruby-forum.com/t/a-security-related-question/175823/1 "2009-09-20T22:46:59Z")

</div>

Hi,

I’m running restful\_authentication plugin on my projects.  
When we login to the app the contents for the form that the login sends  
are clearly available for anyone sniffing traffic. For example locally I  
can see that the form sends:

authenticity\_token=TEzCRYvzJbioHD3rpt3VuWHkl4rmrngRn3V%2BjCM9qz4%3D&login=user1&password=pass1&mobile=false&commit=Log+In

So the username and password can be seen there.

I know https would hide that, also the token is needed for anyone to use  
those credentials later.

But, how can this be considered secure?  
This is not directly related to restful\_authentication plugin, common  
issue with any other forms.

Cheers.

---

<div class="post-metadata">

**Author:** ![comopasta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/59ef9b/32.png) [@comopasta](https://www.ruby-forum.com/u/comopasta)\
**Post date:** [September 21, 2009, 8:16am UTC](https://www.ruby-forum.com/t/a-security-related-question/175823/2 "2009-09-21T08:16:23Z")

</div>

Hi  
In application controller you can say like for example

filter\_parameter\_logging :password (where password is the field  
name)

This the /password/i will be replaced by the value “[FILTERED]”

Sijo

---

<div class="post-metadata">

**Author:** ![comopasta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/59ef9b/32.png) [@comopasta](https://www.ruby-forum.com/u/comopasta)\
**Post date:** [September 21, 2009, 10:00am UTC](https://www.ruby-forum.com/t/a-security-related-question/175823/3 "2009-09-21T10:00:59Z")

</div>

Hi Sijo,

Thanks for the reply. Yes I forgot to mention that one. But  
ilter\_parameter\_logging will filter it in the server logs. My concern is  
before getting that to the server, it goes straight from the browser in  
this form:

authenticity\_token=TEzCRYvzJbioHD3rpt3VuWHkl4rmrngRn3V%2BjCM9qz4%3D&login=user1&password=pass1&mobile=false&commit=Log+In

I guess this is where HTTPS takes the stage…

Regards

---

<div class="post-metadata">

**Author:** ![comopasta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/59ef9b/32.png) [@comopasta](https://www.ruby-forum.com/u/comopasta)\
**Post date:** [September 21, 2009, 11:24am UTC](https://www.ruby-forum.com/t/a-security-related-question/175823/4 "2009-09-21T11:24:51Z")

</div>

Yes you are right