NTLM Authentication - Password is visible (Security Issue)

[Rama16]

Hi,

I see password is visible if I use NTLM authentication. It seems like security issue Please advise.

Thanks

[richie]

Hey @Rama16 

What version of SoapUI/ReadyAPI! are you using?  I'm running ReadyAPI! v2.6.0 and the password is obfuscated and has been for a while - I remember it wasn't in SoapUI v3.5 - but that was years ago!

Cheers,

richie

[Rama16]

Thanks for your reply.

I am using ReadyAPI 2.6.0 with Pro licence.

Please see the screenshot.

Thanks

[TanyaYatskovska]

Just to clarify, @Rama16, do you see the value of the password field?

[Rama16]

Yes. I do see the password. Also, When I saved the project and I see it xml as well.

[NBorovykh · Accepted solution]

Hello @Rama16,

I agree that the password value should be hidden in the request's properties in Navigator as it's hidden in the other panels. I have registered an issue in the internal DB for this.

As for the fact that the password is stored in the project file as-is, it's the expected default behavior. To protect your sensitive data can either encrypt the whole project or selected properties as it's described in this article: https://support.smartbear.com/readyapi/docs/testing/best-practices/secure.html

[Rama16]

Thanks for update. Let me know when this issue is resolved.

-Ram

[Rama16]

Good morning,

Any update on this? Does this issue is resolved?

Thanks,
Rama

[Rama16]

Good morning @NBorovykh,

Any update on this? Does this issue is resolved?

Thanks,
Rama

[NBorovykh]

Hi @Rama16,

At the moment, there is no ETA of a fix to this issue, but I'd like to assure you that the Product Team always treats security-related issues as critical and tries to fix them as soon as possible.