Basic Auth, including Bearer tokens, depend on using TLS to prevent eavesdroppers from getting at your sensitive credentials or tokens. But I think there is an Elephant in the room that nobody talks about.
Users often only type in "www.somesite.com" in stead of "https://www.somesite.com". AFAIK when you don't specify the protocol, the client browser will first try the default, un-encrypted HTTP connection.
The problem is that the user is basically asking for an un-encrypted connection to be made to the server because that's the default when no protocol is specified. The browser could potentially include sensitive information in the request headers, including Basic Auth credentials, Tokens, (and even Cookies that are not set "Secure")
For API clients that send tokens the situation is similar, but partially mitigated by hopefully well written client applications that
- Actually use only the SSL encrypted port to connect to, and
- The Developer actually turned the "Check the SSL certificate" option on before he published their app.
I'm of a mind to set up a MITM proxy on my home network to start checking and logging the apps that I use. In particular I want to spoof some DNS records and see whether the apps actually baulk at sending your credentials/tokens to the wrong server.
I personally would have preferred JWT to be specified as being sent in a SECURE cookie only, rather than in the headers... Does anybody here think my concern is not warranted?
EDIT: To clarify: I'm not so much worried by the weakness of SSL or attacks against DNS, I am more worried about credentials being exposed because clients end up sending it over unencrypted connections in any case, whether due to user's bad behaviour or because the client just follows redirects to SSL ports but only after sending the user's credentials. When designing APIs I will from now on add a listener on the unencrypted port. If it receives any token on that port, it will
- Not Redirect, and
- invalidate the credentials, and
- send the user a warning.
Hopefully developers who write apps that consume these APIs will get the hint. Would blacklisting the IP for a few hours be too harsh?
P.S. Note: With Secure cookies we still depend on the browser being correctly implemented.