Url contains username and password în plain text

[savornicesei]

Hi all,

When entering OpenSubtitiles credentials in Jellyfin, it redirects to

http://localhost:8096/web/index.html?username=<my_username>&password=<my_password>#!/configurationpage?name=Open%20Subtitles?username=<my_username>&password=<my_password>

where my_username and my_password are my credentials for OpenSubtitles.org, in plain text.

It seems they're kept in the url even if I leave the plugin page:

For security reasons they should not be passed in plain text and in the query string.

• Jellyfin v10.7.5
• OpenSubtitles plugin v10.0.0

Thank you.

[uranderu]

I agree this maybe isn't the most clever design. However, there is a quick fix for this, enabling HTTPS :)

[savornicesei]

That is not a fix 😄

[cvium]

Putting the password in the request body instead does not exactly stop sniffing attempts. Use HTTPS.