Magento User Name and Password is visble in browser network in localhost

[inrsaurabh]

I don't know it's normal or what but recently while I am not able to login with correct password i was inspecting the network but I found that we can see the entered admin username and password in the browser network.

[Rakesh Jesadiya]

Yes, This is available in Only Default and Developer mode only.

Once You Change mode to production you can't check your username and password request. For Your Production mode, It is secure and not display under browser console. Now your mode is default or developer so you can access your username and password under network tab of your browser console.

[inrsaurabh]

I changed to production mode even than i can see the username and password in the console.

I am on localhost, and i check on the live server as well on both environment i am able to see the credentials.

Note: These websites have no SSL 

In Magento ver. 1.x we can not see the details in the console

[Rakesh Jesadiya]

I think you have issue related to localhost in  your broswer, Please replace localhost with ip address like http://127.0.0.1 Using  database table core_config_data.

Replace value web/unsecure/base_url and web/secure/base_url with  http://127.0.0.1/{magento2}/

Run Upgrade and setup di compile to check changes.

[Manthan Dave]

Yes It's Normal !!

Actually its just a request headers parameters of login form.

When you pass username and password on login form it will call request url along with its parameters.

so on the same time this parameters are passing through request headers, so it will shows on browser console network tab and this is common for all.

it will not only shown correct password - but it will show the parameters which you have written in that particular textbox.

The same will happen at frontend login form as well.

P.S - Even though you are in production mode with localhost url (127.0.0.1) or with  your domain name it will still shows because its just request headers.

Hope you understand !!

[inrsaurabh]

Thank You for replying 

Ii check on the live server as well on both environment i am able to see the credentials.

[Manthan Dave]

Yes Read my above answer !!

you will get exact idea !! it will shows even though you are in live site - as its request header so

[inrsaurabh]

@Manthan Dave 

1) it will not shown correct password - but it will show the parameters which you have written in that particular textbox.

 It is showing correct password

The same will happen at frontend login form as well.

2) Yes on frontend 

Location: http://subdoamin.mainwebsite.com/customer/account/login/ 
we can see the correct password and username

P.S - Even though you are in production mode with localhost url (127.0.0.1) or with your domain name it will still shows because its just request headers.

No on live website is with real public url as mentioned above

[Manthan Dave]

Yes that's what i am saying !!

As after logged in you are redirecting to that request page !! so it will shows that parameters on request headers of browser console !!

Even though When you enter wrong credentials it will still shows that wrong password on the browser console network tab !! 

[Rakesh Jesadiya]

I have Research about it and they will display for each login form of frontend and backend login form, Its normal flow and each time they display correct username and password of current users data. They don't rely on any mode of magento.

You can check it from file for both backend and frontend, By default, they will pass data with input field and you can check code from below file.

For Backend file,

vendor/magento/module-backend/view/adminhtml/templates/admin/login.phtml

For Frontend  file,

vendor/magento/module-customer/view/frontend/templates/form/login.phtml

So each time after login from any area they will display username and password of the current registered user.