[Question] HTTPS payload not encrypted..?

[HeCorr]

Hello! I'm developing an app which uses the Dio package and when checking the login functionality (and what URLs the app connects to with the DevTools) I noticed that the plain login data (username and password) was exposed in the Request tab, even though the connection was supposed to be encrypted.

I did attempt to sniff a similar request using Wireshark and to the best of my (very limited) knowledge of using it, the request is definitely encrypted, so I'm not sure what's going on.

Is this expected or should I be worried? Thanks!

[kenzieschmoll]

@bkonyi is this a potential problem on the dart:io side or in package:dio?

[bkonyi]

I'd have to dig into things a bit, but there's a chance we log the payload for profiling before encrypting it. If you're seeing everything encrypted in Wireshark, you should be fine.

[kenzieschmoll]

@bkonyi is there any action item to take on this bug or should we close it?

[bkonyi]

I think we can close it. I still haven't verified, but we most likely encrypt the payload at the socket level so this is expected.