防止Asp.net应用程序在HTTP标头中显示密码

Question

As the title goes I'm stuck with a problem. As whenever I login to my portfolio website and test it's http header through firebug NET option I find out that I can see my password in POST request. As I don't know how severe this venerability or not. but I'm quite confused regarding

1. Why HTTP header shows POST fields
2. Is it ok to go with it as i find out that Facebook hadn't done any work for this
3. How to stop showing password post field in ASP.NET C# and PHP as i work on both domains
4. As what i guess HTTP Header works on client side(Browsers) but What works on server side. (Pardon me for my idiocy but I'm quite curious )

Below is screenshot of my problem.

Answer 1

The form post contains the password in the clear, but if a lower layer is encrypted, this doesn't matter. This is why login should always be conducted over a secure HTTPS connection.

If you're allowing logins over insecure (HTTP) connections, your worries are justified. Get yourself a certificate and require HTTPS.