I have an API that uses JWT token-based authentication. In order to get a short-lived token, the client first calls a /Token endpoint, passing username and password in the body of the request. As I understand it, this is a standard way to implement JWT.

I am trying to understand the difference between the way that this initial /Token endpoint is called; and calling an API that uses Basic authentication. With Basic authentication, the username and password would be passed in the Authentication header; and then validated on the server side. This seems to be the same basic idea as what we are already doing; except that instead of passing username and password in the authentication header, it is being passed in the request body.

Is there a security difference between these two methods of passing username and password to an API? Would it make sense to implement Basic authentication on our /Token endpoint instead? (Currently there is no Authentication header; but the server will return 401 if the username and/or password are missing or incorrect).

If it matters, the API is written in .Net Core; I'm aware that there are differences in terms of how the server code is written (data in the authentication header can be automatically validated using the [Authorize] attribute on the methods); but I am wondering about security differences in the actual data transfer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.