1

I use Vue.js on frontend and GoLang on backend. With Vue I'm sending AJAX request with credentials for sign in/sign up. Should I use HTTP Basic Auth, or just send them in request body? In case you are wondering, I'm using HTTPS. After the initial request, I'm sending back a session cookie, which I will use for successive requests.

2

Don't use Basic authentication, it's an old authentication scheme that provides no benefit over cookie or token based session management. When using basic authentication credentials serve as a session identifier, therefore needs to be sent in every request. This has two big downsides:

  • Credentials are stored in the browser's cache in plaintext which may be abused in some scenarios

  • Session can not be terminated as it's attached to user credentials and credentials have no concept of expiracy as JWT, cookies or other kind of tokens have (Note: When saying expiracy I'm not referring to password expiracy as in "Need to change password every 3 months" but credentials as an authentication scheme)

Even if you attempt to use basic authentication to then send a session cookie browsers will keep sending the credentials in the authorization header.

If you're using AJAX requests my advice would be to stick with cookie based authentication or migrate to JWT. Note that if the API is being called from a different hostname (f.e. www.example.com calls an api in api.example.com), the corresponding CORS headers to allow credentials should be properly set

|improve this answer|||||
  • I wouldn't consider Basic Auth obsolete as there are times when its necessary. Rather it should be used for situations when an application is unable to use the preferred method (as you've pointed out) of tokens or cookies to maintain authentication. – user2320464 Sep 16 '18 at 16:26
  • I second that Basic Auth is not necessarily obsolete. It's not inherently insecure, there's just better auth methods available. Given a choice between Basic Auth and no authentication (or someone's "brilliant original idea" for auth), I'd pick Basic Auth any day of the week. – nbering Sep 16 '18 at 22:50
  • 1
    Agree, saying basic authentication is obsolete was a bit too much. Anyway it's an old authentication system and shouldn't be used unless there is really a good reason – Mr. E Sep 16 '18 at 23:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.