How to encrypt values sent in DispatchBrowserEvent in blazor Server Side

user_17340824 0
Viewed 122

Recently we deployed a Blazor application to one of our clients. When their internal team did a WARP test, we got a finding "ClearText transmission of Sensitive Information". When we analyzed it we found that the Blazor heartbeat is sending values typed in every input field to the server via "DispatchBrowserEvent". Given below is a screenshot of the same. DispatchBrowserEvent

I need a solution to either

  1. Encrypt the value being sent in the DispatchBrowserEvent or
  2. To Stop the transmission of the values until its manually posted.
websecurity signalr blazor-server-side blazor
1 Answers

Blazor Server uses SignalR as the communication mechanism so data is sent back and forth to the server. It should be on an encrypted channel using SSL/TLS, so I assume your site has SSL enabled?

Login credentials have to be sent from the browser to the server in a POST to validate them. This is the same for all web applications. You just have to ensure that the requests are done over SSL so that only the client and the server can read them. This is not a security issue if this the case.

Secondly, the preferred mechanism SignalR/Blazor-Server uses is WebSockets. If your app was using a WebSocket connection you would not see the traffic you are seeing - this is because SignalR will fall back down to alternative methods if WebSockets are not available.

You should check your server to see if WebSockets is enabled - I suspect that is the cause.

user_414030
Related