topic How to secure the login API in Alfresco Forum https://connect.hyland.com/t5/alfresco-forum/how-to-secure-the-login-api/m-p/53469#M19941 <HTML><HEAD></HEAD><BODY><P>Hi All,</P><P></P><P>During the security test of our instance our security expert asked us to secure the login API&nbsp;</P><PRE class="" style="color: #000000; background: #f5f2f0; border: 0px; margin: 0.5em 0px; padding: 1em 1em 1em 3.8em;"><CODE style="border: 0px; font-weight: inherit;"><A class="" href="http://www.myserver.com:8080/alfresco/service/api/login?u=me&amp;pw=mypassword" rel="nofollow noopener noreferrer" style="color: #0d47a1; border: 0px; font-weight: inherit; text-decoration: underline; padding: 0px calc(12px + 0.35ex) 0px 0px;" target="_blank">http://www.myserver.com:8080/alfresco/service/api/login?u=me&amp;pw=mypassword</A></CODE></PRE><P></P><P>as it send the username and password as it is and can be used by attacker to forge the request login if the admin password is known.</P><P></P><P>Can anyone tell me how we can secure this API or in my case I can disable it also.</P><P></P><P></P><P>Thanks</P><P>Hiten Rastogi</P></BODY></HTML> Mon, 21 May 2018 07:17:26 GMT hiten_rastogi1 2018-05-21T07:17:26Z How to secure the login API https://connect.hyland.com/t5/alfresco-forum/how-to-secure-the-login-api/m-p/53469#M19941 Hi All,During the security test of our instance our security expert asked us to secure the login API&nbsp;http://www.myserver.com:8080/alfresco/service/api/login?u=me&amp;pw=mypasswordas it send the username and password as it is and can be used by attacker to forge the request login if the admin passwor Mon, 21 May 2018 07:17:26 GMT https://connect.hyland.com/t5/alfresco-forum/how-to-secure-the-login-api/m-p/53469#M19941 hiten_rastogi1 2018-05-21T07:17:26Z Re: How to secure the login API https://connect.hyland.com/t5/alfresco-forum/how-to-secure-the-login-api/m-p/53470#M19942 <HTML><HEAD></HEAD><BODY><P>Configure your system to use HTTPS / SSL only, and use a proxy / gateway to disallow the use of the GET-based login operation. The POST-based login operation (same URL, only using JSON post body instead of URL parameters) should be the only one allowed to avoid username / password to appear in any access logs.</P></BODY></HTML> Mon, 21 May 2018 09:05:19 GMT https://connect.hyland.com/t5/alfresco-forum/how-to-secure-the-login-api/m-p/53470#M19942 afaust 2018-05-21T09:05:19Z