DevTest authentication credentials are passed as raw data

Products

• CA Application Test
• CA Continuous Application Insight (PathFinder)
• Service Virtualization

Issue/Introduction

Though the DevTest Portal is setup for HTTPS, on Network tab of Portal/ED browser seeing Authentication credentials being passed as raw data and causes a security risk. 

Environment

All supported DevTest releases.

Resolution

The Developer Tools, Network tab shows HTTP data before it is sent to the server and it shows when the the tool is opened and credentials are entered. Open the Developer Tools after the login was performed, no information will be available. 

To verify if the DevTest authentication data is being passed as raw data need to use a network traffic analyzer, like Wireshark, to capture the data and verify how the username and password are being transmitted in the network. If using HTTP/S all communication between the client and server is encrypted. This has been tested and verified.