0

Is it correct that there are various ways that a HTTP client can authenticate itself with a HTTP server?

Are the following such ways?

  1. authorization header: for various authorization protocols (e.g. basic, digest, ...)

  2. digital certificates: as used in HTTPS.

  3. specify user name and passwords in HTTP request's message body, by applying HTTP POST method on form data

Are they used individually or together? Are they used for the same or different purposes? When is each way used?

In the second way, is digital certificates specified in some HTTP request header(s)? (In curl, it is specified via --cerf)

In the third way, when specify user name and passwords in HTTP request's message body, are they encrypted? Does the server know how to decrypt them?

Improve this question
1
  • The server sets up authentication however it wants. You could embed the password as ASCII art if you wanted to. As a result there isn't really an answer to any of these questions. This is a lot like asking "how do people eat food?"
    – Conor Mancone
    Commented Feb 10, 2020 at 2:23

1 Answer 1

Reset to default
2

Is it correct that there are various ways that a HTTP client can authenticate itself with a HTTP server?

Yes. There are many, many ways. Custom authentications schemes are common.

Are the following such ways?

  1. authorization header: for various authorization protocols (e.g. basic, digest, ...)
  2. digital certificates: as used in HTTPS.
  3. specify user name and passwords in HTTP request's message body, by applying HTTP POST method on form data

Yes. Those are all ways authentication can happen. Although, nota bene, client certificate authentication usually involves the Authorization header with protocol = digest. Also sending username and password in a POST body is sloppy unless you're creating an account. It works, but it's sloppy. unusual unless the request is coming from an actual HTML form.

Are they used individually or together? Are they used for the same or different purposes? When is each way used?

Only one authentication scheme is used at a time. Digest authentication is used when replay attacks are a real threat. Digest authentication involves a nonce such that the same MAC will not work twice. Basic authentication is more vulnerable to replay attacks but TLS encryption would need to be broken (or absent) to make this possible.

Client certificates are used when the server wants to check the veracity of the client's claimed identity using a trusted third party.

In the second way, is digital certificates specified in some HTTP request header(s)? (In curl, it is specified via --cerf)

The client certificate itself would be specified in the body of an HTTP request. Client certificate authentication requires multiple requests and responses passed statefully.

In the third way, when specify user name and passwords in HTTP request's message body, are they encrypted? Does the server know how to decrypt them?

They are encrypted if the request body itself is encrypted. This is the case in any https request. If you want details of the encryption and decryption system, read about TLS/SSL.

Improve this answer
20
  • Sloppy to send login/password in a POST?! Most every CMS I've encountered (such as Wordpress) does just that. For an API it's less likely you'd want to use such, but that doesn't make it sloppy.
    – Alexis Wilke
    Commented Feb 10, 2020 at 0:05
  • Thanks. 1) "Basic authentication is more vulnerable to replay attacks but TLS encryption would need to be broken (or absent) to make this possible." Do you mean basic authentication is always/often used with TLS i.e. HTTPS? 2) "Client certificates are used when the server wants to check the veracity of the client's claimed identity using a trusted third party." In HTTPS, is client certificate used always/often? 3) In most cases, which way(s) (including not listed in my post) is used for client to authenticate itself to server?
    – Tim
    Commented Feb 10, 2020 at 0:13
  • 1
    @Tim 1) Yes, basic authentication should never be used without TLS unless you are on very trusted subnet (i.e. IPC through localhost). 2) HTTP client certificate authentication is rare, in my experience. 3) By far the most common authentication method on the modern internet is token authentication using tokens saved in cookies and refreshed periodically. The most common method of obtaining the token is Basic authentication. Check out OAuth2.
    – William Rosenbloom
    Commented Feb 10, 2020 at 0:30
  • 2
    Definitely still a POST. Simple form + POST = easy to implement. Here is a screenshot (a bit deleted for privacy) which shows the the first thing that happens when I click Login is a POST and I show the parameters to the right side.
    – Alexis Wilke
    Commented Feb 10, 2020 at 0:34
  • 1
    Since this is a security site, I wanted to point out that one of the first implementations of "Remember Me", a plugin that was added to Wordpress would actually save the login & password to a cookie, unencrypted. Imagine the joy of the Wordpress hackers! (Note: it was not implemented by the Wordpress authors; it was an extension by someone else who didn't know much about security.)
    – Alexis Wilke
    Commented Feb 10, 2020 at 22:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .