Question

I want to call a web service using javaScrip but the web service call contains user name and password, so i am thinking of storing the values of the user name and password in a hidden fields , then to construct the web service URL using javaScript by appending the values of the username and password. Incase i am going to implment https for these web service calls , then will storing the values of the username and password as hidden fields inside the html page consider secure?

Answer 1

Absolutely yes, hackers will be able to see the value of the hidden field. Hidden fields in HTML are easily visible, to anyone who looks at the page source.

To show this, here is a bit of code from the google log in page.

<form id="gaia_loginform"
      action="https://www.google.com/LoginAction2?service=mail" method="post"
      onsubmit="return(gaia_onLoginSubmit());">
<div id="gaia_loginbox">
<table class="form-noindent" cellspacing="3" cellpadding="5" width="100%" border="0">
  <tr>
  <td valign="top" style="text-align:center" nowrap="nowrap"
        bgcolor="ddf8cc">
  <input type="hidden" name="ltmpl"
             value="default">
  <input type="hidden" name="ltmplcache"
             value="2">

Notice this in particular:

Hidden means it doesn’t show up on the web page, but is still included in the source. All someone would have to do would be to navigate to the page, look at the source, and they could find any hidden entries.