Hide Authentication Metadata

[SentryMan]

Expected Behavior

Metadata containing mimetype message/x.rsocket.authentication.v0 should be obscured

Actual Behavior

The auth metadata can be seen clear as day: https://files.gitter.im/5ed4cb46d73408ce4fe5880a/YLtF/Screenshot-2-_LI.jpg

[SerCeMan]

Hey, @SentryMan! This one is a bit tricky in the sense that it's possible to mask the authentication information in the extension. However, the same information is also available in the Network tab next to RSocket Frames in the same unmasked form.

[SentryMan]

Is that how it works? On my screen I just see garbled text.

[OlegDokuka]

Hi @SentryMan!

What @SerCeMan mentioned, is that it is possible to hide the AuthMetadata content in the addon UI, however, if the connection is unsecured and there is a man in the middle, then all the traffic can be sniffed and all content can be easily decoded. Thus, if it is only for browser needs so someone who looks at your screen will not see the auth content - then yeah, it is possible to hide it via UI feature, however, it does not protect you against any Man-in-the-middle attack or any traffic sniffing techniques

[SentryMan]

Thank guys for responding.

I got the concept of preventing MitM attack using secured connections. I was more wondering if people being able to use this UI tool to see the auth data being passed was intended.

[SentryMan]

Since the binary data in the network tab was showing up all garbled(why is that btw?), I thought maybe it would be a way to truly hide auth credentials. Though now that I think of it, someone could write their own version of this extension that would show the credentials.

[SerCeMan]

Is that how it works? On my screen I just see garbled text.

@SentryMan To clarify, what you can see on the screen is not garbage but Base64. If you paste it into https://www.base64decode.org/, you'll be able to see the content. Chrome also has the text view, however, it was broken in the last few versions, https://stackoverflow.com/questions/65474220/chrome-devtools-the-encoding-switch-bar-of-the-websocket-frame-viewer-disappear/65516229.

[SentryMan]

Well, I guess you learn something new everyday. I guess we're fine as is then.