I have a customchain running on a private server. I am also running a provider using geth, to which I am connecting from the browser using let web3 = new Web3(http://xxxxxx:8545).
My browser client connects to the provider and can issue transactions after they unlock the account using web3.eth.personal.unlockAccount(..., password).
The [web3.js documentation] states:
Sending your account password over an unsecured HTTP RPC connection is highly unsecure.
This confused me because I assumed that the browser recieves the keystore json object from the server, does the decryption locally using a password, and uses the unlocked account to sign transactions, which are send to the provider who then in turn would send this transaction to the chain.
The above quote from the documentation makes me think that the password may be sent to the provider and the provider does the signing etc. This obviously is not the case.
So my question is this: "At any point, does the web3.js client send the password to the provider?" : https://web3js.readthedocs.io/en/v1.2.7/web3-eth-personal.html#unlockaccount