Is this correct? Should firebug see SSL-protected AJAX?

Question

I have enabled SSL and I am doing a jQuery AJAX post request and sending some fields to the server.

When I look at the AJAX post request through firebug under the post parameters I see all the fields in clear text.

So this means I can see the passwords in clear text. Is this normal? I am also looking at it with fiddler and it does not even log this AJAX request(so its like the request was never made).

So is it just because firebug is installed in the browser and can capture it or what?

Answer 1

ssl enables security when the data moves from browser to web sever. Firebug is a browser plugin, it knows everything in the DOM tree. I think it makes sense for firebug display the input fields and form data.