Strapi: Password Encryption in Request Body

[wes-cutting]

• [ x ] I have created my request on the Product Board before I submitted this issue
• [ x ] I have looked at all the other requests on the Product Board before I submitted this issue

Please describe your feature request:

The email and password are sent as plain text in all requests. Is there a feature already in place to encryption these fields in the request body?

[lauriejim]

Hum password are sent as plain text in all requests can you explain please. I'm not sure of what you mean.

[wes-cutting]

I guess a better way to ask this would be: where is the API encryption handled in the Strapi Code?

The plain text password that is seen in the documentation, 'strapiPassword', doesn't get stored in the DB. Somewhere in the code base that plain text is encrypted. So the frontend can encrypt that plain text before it is sent across the wire, then Strapi does another layer of encryption before it is stored in the database. I'd like to know if there is a way to swap out what Strapi is using to encrypt the passwords.

[derrickmehaffy]

@wes-cutting if you have https setup, then you are already encrypting it. More than likely the location is in the user permissions plugin, a bit of searching around and you can probably find it