Session files store auth credentials in plaintext

[themavik]

sessions.py stores auth.raw_auth (which can contain passwords and tokens) directly in the session JSON file under ~/.config/httpie/sessions/. post_process_data only handles cookies and headers but leaves the auth block as-is.

Anyone with read access to the user's config directory can extract credentials from session files.

[attoba]

Hi! I explored this issue and i’m considering integrating OS-level secure storage via Python keyring:

• Store credentials in keyring
• Store only a reference in session file
• Keep backward compatibility with existing sessions

Would this direction be acceptable?