How to hide the password from the URL of the email request and browser dump

Question

This may be an old question, but I still have not found the right answer to this question, so please be patient. I have an https login page that uses the form submission method and sends the credentials to the server ... blah blah.

During login, if you use IE and F12 to monitor the network, click start capture. You can see a URL similar to login, servetloginauth (from gmail.com), and you can see the request body with your username and password. Well, it can be argued that only if the user has not logged out, you can see it.

Now log out and do not close the browser and do not remove the browser (any browser, any version) from the task manager (I'm not sure how to do the same on a Mac). Use the WinHex editor to open the dump file and do a search / search: "password =" or the actual password (since you are checking your own username, you already know your password). You can see the password in text form.

Now my question is: how can I hide the password: 1. Either the URL of the send request 2. Or when the browser saves my credentials in a dump, I will mask / encrypt it or should not save the password at all.

My code for jsp:

<s:form id="login" name="loginForm1" action="login" namespace="/" method="post" enctype="multipart/form-data" >  
      <fieldset><!-- login fieldset -->
        <div><!-- div inside login fieldset -->
                <div....
                  <label for="password" class="loginLabel">Password</label>
                  <input type="password" name="password" id="password" class="longField nofull absPosition" size="16" autocomplete="off" alt="Password" placeholder="Password" title="Password|<

I have the current solution, as shown below, but I need any alternatives without much effort.

, . . - , . , . , Login . JavaScript , . POST.

, . , .

POST cleartext

SHA 256 - , - JavaScript " Reads".

. , , , JavaScript,

- .

, , Citibank -. - , ( -), -, . - , , .

Answer 1

, , . ( ), , . - -. ( ), , , .

, , .

, , . ( ) . ( , ). , , , . , , . - . ... , .

, : . . , , . , , , . , , , .

Answer 2

. , -, /.

, MITM, X , . , X . , .

. , .

gpEasy: http://gpeasy.com/ , Sha-256, 50 . 950 . 1000 . , " "

def hash(self, pw, loops = 50):
    pw = pw.strip()

    for i in range(loops):
        salt_len = re.sub(r'[a-f]', '', pw)

        try:
            salt_start = int(salt_len[0:0+1])
        except ValueError:
            salt_start = 0

        try:
            salt_len = int(salt_len[2:2+1])
        except ValueError:
            salt_len = 0    

        salt = pw[salt_start:salt_start+salt_len]
        pw = hashlib.sha512(pw.encode('utf-8') + salt.encode('utf-8')).hexdigest()
    return pw

.