nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

How to secure the login API

hiten_rastogi1

Hi All,

During the security test of our instance our security expert asked us to secure the login API

http://www.myserver.com:8080/alfresco/service/api/login?u=me&pw=mypassword

as it send the username and password as it is and can be used by attacker to forge the request login if the admin password is known.

Can anyone tell me how we can secure this API or in my case I can disable it also.

Thanks

Hiten Rastogi

Find more posts tagged with

Alfresco Content Services

Comments

afaust

Configure your system to use HTTPS / SSL only, and use a proxy / gateway to disallow the use of the GET-based login operation. The POST-based login operation (same URL, only using JSON post body instead of URL parameters) should be the only one allowed to avoid username / password to appear in any access logs.