Question

I have an initial login screen where we can enter a “username” and “password”.
I have four views and I am using the “username” and “password” entered in the first login view to establish an SSH connection in the fourth view.

To pass and use the username and password, I’m passing them through a hidden_field_tag in all these views, and when we click on the submit button, these hidden field values are passed to the second view.

All these submits are get requests.

The username and passwords are appearing in the URL as I am passing them as parameters.
If I use a post request instead of a get, the page expires when I click on the back button in my browser.

Is there anyway to hide/encrypt those parameters in the URL?

Thanks.

Answer 1

I don’t think you’re going to be able to hide them as we know GET exposes the params. I’m wondering if you can store them in the session instead? I don’t know what you’re doing off hand but the logic seems a bit opaque. Maybe you can re-think the logic into more of a common pattern. Good luck!