How to make password encrypted in AD B2C Custom Policy ?

Question

Hi Team,

We are using custom policies for sign in and sign up of ad b2c user flows. The password is shown as plain text in form data when user signs in or signs up which seems to be a security flaw and makes system vulnerable for attack ...how can I encrypt the password being sent..?

Answer 1

Hi @Ronnie Kapoor • Thank you for reaching out.

You may consider using Hash claims transformation for this purpose, as mentioned below:

<ClaimsTransformation Id="HashPasswordWithEmail" TransformationMethod="Hash">  
  <InputClaims>  
    <InputClaim ClaimTypeReferenceId="password" TransformationClaimType="plaintext" />  
    <InputClaim ClaimTypeReferenceId="email" TransformationClaimType="salt" />  
  </InputClaims>  
  <InputParameters>  
    <InputParameter Id="randomizerSecret" DataType="string" Value="B2C_1A_AccountTransformSecret" />  
  </InputParameters>  
  <OutputClaims>  
    <OutputClaim ClaimTypeReferenceId="hashedPassword" TransformationClaimType="hash" />  
  </OutputClaims>  
</ClaimsTransformation>  

Read more: https://learn.microsoft.com/en-us/azure/active-directory-b2c/general-transformations#hash

Having said that, the traffic to Azure AD B2C is sent over HTTPS and form data is visible when you have access to the private key to decrypt the SSL traffic. If you are checking it using Fiddler or Browser Tools (F12), you must be seeing the decrypted traffic but if some malicious user captures the traffic over the network, he/she won't be able to inspect the SSL traffic.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.