How to secure the login API

[hiten_rastogi1]

Hi All,

During the security test of our instance our security expert asked us to secure the login API 

http://www.myserver.com:8080/alfresco/service/api/login?u=me&pw=mypassword

as it send the username and password as it is and can be used by attacker to forge the request login if the admin password is known.

Can anyone tell me how we can secure this API or in my case I can disable it also.

Thanks

Hiten Rastogi

[afaust]

Configure your system to use HTTPS / SSL only, and use a proxy / gateway to disallow the use of the GET-based login operation. The POST-based login operation (same URL, only using JSON post body instead of URL parameters) should be the only one allowed to avoid username / password to appear in any access logs.