在轨道上的红宝石中确保参数

Question

I'm having a form that dont actually saving a model, so When i do POST the form, there is email and password, but somehow I dont want to expose my password to others. I did this config.filter_parameters to filter in the log

but when I POST and I check browser, there are still having plain text for my password which I dont want to. Is there any proper way to encrypt the params when sending that when I inspect in the browser, everyone will just see hashes or encrypted.

Oh ya,I meant the way not using SSL as well >.<

Answer 1

If you can't use SSL, then you can't be secure.

Even if you did private/public key encryption with JS before sending the passwords over the network, you can't trust that your encryption JS code wasn't compromised when being sent to the client. After all, you want to encrypt because you are worried about network vulnerabilities.

Of course, you could use JS encryption over an insecure protocol to give the illusion of security. To be fair, the attack to compromise the passwords in this scenario would need to be more sophisticated than simple network sniffing.

A great article on this topic is here: http://www.matasano.com/articles/javascript-cryptography/