Pita/etherpad-lite — Issue #230: Etherpad lite stores user passwords in plain-text cookies
Author: jaseg
Created: 2011-11-24 19:44:26+00:00
State: open

From a security point of view this is bad. A cookie should not contain more than a session id or a (limited-time) token. The current behavior e.g. leaks an user's password with each XSS flaw.