Forum Discussion

gregory_mooney's avatar
gregory_mooney
Icon for Staff rankStaff
11 years ago

User/Pass Stored in Plain Text in the XML of Project

Current situation:

1)      Projects can be encrypted, so all passwords are encrypted as well in the project file.

2)      SoapUI 4.6 had a bug that left some passwords un-encrypted. That was fixed in 4.6.3  (https://smartbear.atlassian.net/browse/SOAP-1143). 

 

If encryption is used you still have to share the key to decrypt it, so the passwords stored in the project file will be visible to anyone (in the team)  that gets the key.

Which, in fact should be ok, because any passwords the team needs for accessing the API:s must be accessible for anyone in the team.

 

You shouldn't be storing your own personal passwords in a shared project. The APIs shouldn’t rely on someone’s private pw, they should represent specially created test users.

1 Reply

  • a212's avatar
    a212
    New Contributor
    11 years ago

    Hi

     

    Do I understand correctly?

    There is no way to read a password from a file that is not a properties file storing the password somewhere in the project?

     

    We have to share projects and we are not allowed to have technical users. So every user has to use his own account and password. That way any changes to the database can be traced to a real person. This security policy is not negotiable.

     

    To have the own password visible to others is really is a very very bad situation.

     

    Can paying customers file a request for improvement somewhere?

     

    Sincerely

     

    F. Arndt