Are Confluence passwords hashed over http?

If I connect to confluence over non-https, are passwards encrypted?

2 answers

1 accepted

0 vote
Joseph Clark Atlassian Team Jun 13, 2012

Correct, unless you implement some form of custom authentication, passwords and usernames are sent in clear-text when logging in to Confluence.

SSL for the win :-)

Someone else can step in and correct me if I'm wrong, but I decided to explore this a little. However, it's very possible I do not understand how auth works with Confluence (or with servers in general), so take this for what it's worth (almost nothing).

If you request the admin URL:

http://yoursite.com/confluence/authenticate.action?destination=/admin/console.action

Now turn on your network monitor (in my case, I used Chrome's Network tab), enter your password, and click "Confirm".

Then look at the request, it looks like it is NOT encrypted. Here's a dump of my request. The password is in the form data, in plain text:

Request URL:http://yoursite.com/confluence/doauthenticate.action
Request Method:POST
Status Code:200 OK
Request Headers
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Charset:ISO-8859-1,utf-8;q=0.7,*;q=0.3
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-US,en;q=0.8
Cache-Control:max-age=0
Connection:keep-alive
Content-Length:82
Content-Type:application/x-www-form-urlencoded
Cookie:confluence.browse.space.cookie=space-pages;
<snip>
Host:yoursite.com
Origin:http://yoursite.com
Referer:http://yoursite.com/confluence/authenticate.action?destination=/admin/console.action
User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Form Data
password:PASSWORD
authenticate:Confirm
destination:/admin/console.action

Suggest an answer

Log in or Sign up to answer
How to earn badges on the Atlassian Community

How to earn badges on the Atlassian Community

Badges are a great way to show off community activity, whether you’re a newbie or a Champion.

Learn more
Community showcase
Posted Thursday in Off-topic

Friday Fun: Magic Eyes

...staring into the background. Once the image pops out in 3D, you can look around the picture and enjoy. If you will see if you are a true illusion master! :) You did it? :) Wow! Awesome! As a bonus...

461 views 83 11
Join discussion

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you