Oracle Access Manager (OAM) Browser HTTP Headers Plugins Show Log-in Flow Posts Of Credentials In Clear Text (Doc ID 2940883.1)

Last updated on JULY 26, 2024

Applies to:

Goal

Why does a browsers HTTP header plugin show the username and password used in the login process?

Background
In a browser session, a plugin is used to view HTTP Headers of the login process. When the login process prompts for credentials (username/password), it show the POST of this data in clear text.

Steps to Reproduce
1. Access to protected page by Oracle Access Manager (OAM)/WebGate
2. Enable HTTP HEADER capture in browser
3. Enter username/password on OAM single sign on page
4. View headers in the browser shows Username and Password in clear text

Solution

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.