ASP.Net Core Identity : Credential Obfuscation

Question

I am new to ASP.Net Core Identity and new to Encryption.

I followed the article @ https://learn.microsoft.com/en-us/aspnet/core/security/authentication/identity?view=aspnetcore-6.0&tabs=visual-studio

I created a new Web App using ASP.NET Core Web App template. with Authentication type as Individual User Accounts.

After the project is created, i ran Update-Database

I then Ran the app and registered a new user with following details

Input.Email: ******@somedomain.com

Input.Password: Hello@2023

Input.ConfirmPassword: Hello@2023

When i click Register in the form ""Create new Account", I see that email and password is sent as plain text without an encryption. Observed this @ Payload section of Network tab in chrome.

Question : Do i need to write code to do client-side encryption OR need to setup some configuration so that encryption is done without writing any code.

Answer 1

The login page (as should the whole site) needs to use ssl (https) to be secure. The password is hashed in the database and the cookie is encrypted.