KRYSTALM7 opened a new issue, #101:
URL: https://github.com/apache/fineract-loan-origination/issues/101
## Description
The current login flow transmits the user's password as plaintext in the
request payload. Although local development over HTTP is expected, the
browser's network tab exposes the raw credentials in transit, this is not
acceptable for any staging or production deployment.
As raised during feedback: the network tab shows exactly what is sent over
the wire. The password must be encrypted **before** it leaves the
browser,regardless of transport layer.
## Current Behavior
- `POST /api/v1/auth/login` and `POST /api/v1/auth/staff/login` accept a JSON
body containing the password in plaintext.
- The password is visible in the browser's network tab on every login
request.
- There is no client-side encryption before the payload is sent.
## Expected Behavior
- The frontend fetches an RSA public key from the server before login.
- The password is encrypted client-side using the server's public key before
being sent in the request payload.
- The server decrypts the payload using the corresponding private key, which
is generated in memory and never persisted or exposed.
- The plaintext password is never transmitted over the network.
- Encrypted variants of the login endpoints handle the new flow:
`/api/v1/auth/login/encrypted` and `/api/v1/auth/staff/login/encrypted`
## Proposed Implementation
**Backend:**
- Add a `CryptoKeyController` exposing `GET /api/v1/auth/public-key` to
serve the RSA public key to the client.
- Add a `crypto/` package containing RSA-2048 key pair generation logic,
with the key pair generated in memory on startup, private key never
leaves the server.
- Update `AuthController` to handle encrypted login requests at the
`/encrypted` endpoint variants.
- Update `FineractAuthenticationProvider` to support decryption before
credential validation.
**Frontend:**
- Add `PayloadEncryptionService` to fetch the public key and encrypt the
password client-side before dispatch.
- Update `AuthService` and `StaffAuthService` to use the encrypted login
endpoints by default.
## Files Involved
**New files:**
- `frontend/src/app/core/services/payload-encryption.service.ts`
- `src/main/java/org/apache/fineract/los/api/CryptoKeyController.java`
- `src/main/java/org/apache/fineract/los/crypto/` (key generation package)
**Modified files:**
- `frontend/src/app/core/services/auth.service.ts`
- `frontend/src/app/core/services/staff-auth.service.ts`
- `src/main/java/org/apache/fineract/los/api/AuthController.java`
-
`src/main/java/org/apache/fineract/los/security/FineractAuthenticationProvider.java`
- `src/main/java/org/apache/fineract/los/security/RateLimitFilter.java`
## Acceptance Criteria
- [ ] `GET /api/v1/auth/public-key` returns a valid RSA-2048 public key.
- [ ] RSA key pair is generated in memory on startup — private key is never
persisted or logged.
- [ ] `POST /api/v1/auth/login/encrypted` and `POST
/api/v1/auth/staff/login/encrypted` accept and correctly decrypt encrypted
payloads.
- [ ] Frontend encrypts the password using the server's public key before
sending any login request.
- [ ] Plaintext password is no longer visible in the browser network tab on
login.
- [ ] Plain `/login` endpoints remain functional for local development.
- [ ] Existing authentication tests continue to pass.
- [ ] No credentials appear in logs or response bodies.
## Security Context
This complements the existing server-side hardening already in place:
- Argon2id password hashing (BCrypt-compatible fallback)
- `Cache-Control: no-store` on login responses
- CSP and security headers (nosniff, Referrer-Policy, Permissions-Policy)
- HSTS configured for HTTPS deployments
- Credential-related fields removed from response bodies and logs
---
**JIRA:**
[FINERACT-2442](https://issues.apache.org/jira/browse/FINERACT-2442)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
