For a project at work I'm currently implementing a not too large webservice. For reasons of learning something new I tried making it a REST service, which then prompted the issue of authentication. I eventually settled on HTTP Basic Auth since it has the benefit of being supported by pretty much any HTTP library, even though I had to implement the server side myself.
Yesterday a colleague suggested I should just send the hashed password instead of username and password in plain (eventually the service will be accessible only via HTTPS so I considered Basic Auth not to be a security problem, but let's leave that aside for now). But I wondered what it actually would change, security-wise.
Sending the hashed password basically means a bcrypt hash since that's what we store in the database. Which means I would first have to send the client the work factor and salt so they can arrive at the same hash I have in the database. This requires a challenge-response mechanism which already is much more complicated to implement.
Then there is the point that the hashed password the client sends for authentication essentially functions like a plain-text password, as far as auth is concerned; and could easily be replayed, should someone get hold of it.
So basically, what I found:
- It solves sending the password in plain, similar to Digest, as opposed to Basic
- It doesn't solve the replay issue (Digest does, due to using a nonce) of Basic
- It requires password hashing on the client with less predictable performance. E.g. smartphones likely require smaller work factors than desktop machines and the main consumers of the API would be smartphones and tablets. So we would have to reduce strength of bcrypt in that case.
- It would be far more complex to implement, both in the client and server, due to a custom challenge/response scheme and thus more room for errors. It probably goes against REST principles as well.
Did I miss anything? HTTPS solves the problems of Basic auth, as far as I understood and thus the custom scheme doesn't solve any actual problem, apart from developer boredom maybe. But I'm no expert on any of this.