What is an accepted way to get authentication credentials (login and password) when using webapp?
I'm pretty sure that they get submitted and/or interpreted differently than the rest of the information coming through the request and I'm afraid I can't remember where exactly I'm supposed to get them from.
FYI: The requests are forced to https
Thanks!
If you've got HTTPS enabled, sending them along with the request (usually a POST) is acceptable, and the "standard" method of logging in.
If you want to get clever, you could hash the password using SHA1 on the client end so that even an sslstrip won't reveal the password in plaintext (though it won't prevent replay attacks).
Getting login credentials when using webapp