Question

So in the sake of security I force all password change requests to validate through a password check. The problem I have is that using a debug($this->request) call I’m seeing a plaintext password:

object(CakeRequest) {
    ...snip...
    data => array(
        'User' => array(
            'password' => '*****',
            'password_check' => 'asdfa',
            'id' => '38'
        )
    )
    ...snip...
}

Should this be a concern for me? Is there a way I can have password_check treated like a password?

Answer 1

as long as you don’t actually print it anywhere on the page you will be fine!