vaadin/framework

PasswordField should not contain real password

Open

#10,544 opened on Jan 17, 2018

View on GitHubContributor guide
 (11 comments) (0 reactions) (0 assignees)Java (715 forks)auto 404
Good First IssueHelp wantedenhancement

Repository metrics

Stars
 (1,806 stars)
PR merge metrics
 (PR metrics pending)

Description

This behavior is working as described in the documentation:

Unless the server connection is encrypted with a secure connection, such as HTTPS, the input is transmitted in clear text and may be intercepted by anyone with low-level access to the network.

I think it would be good practice to not reveal the actual password to the browser. The PasswordField should handle this transparently.

This was observed with Vaadin 8.2.1, but since it is working as documented, every version will be affected.

Contributor guide

Research direction
Investigate how PasswordField is rendered in Vaadin and explore ways to prevent the actual password from being sent to the browser, such as masking or placeholder replacement.
Tech stack
java
Domain
frontend
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Java
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
50