0

I would like to know if the Basic Authentication header for site A can be sent from site B when trying to access site A for non-GET requests (which would make the site vulnerable to CSRF attacks).

I tried to call a site on localhost from a HTML file (at file://), and from what I see the Authorization header is sent. Is there a way to make the basic auth header only be sent if it's the same site, or when accessing directly from the browser address bar, like when clicking in a link? I would like to make it work just like the cookie SameSite attribute with the value Lax:

Cookies are allowed to be sent with top-level navigations and will be sent along with GET request initiated by third party website.

This effectively stops CSRF attacks (not originated from XSS, of course) as long as GET requests ar safe (don't change state) and the browser supports it (most browsers support it already).

I would like to know if there is something similar that I can do for Basic Auth. If it helps, I'm handling the basic auth in nginx.

Improve this question

1 Answer 1

Reset to default
2

Like a normal (not same-site) cookie the Authorization header for Basic Authentication is always send with a normal HTTP request when the site is accessed and credentials are known, no matter if cross-site or not. There is no way to specify a different policy for this header.

Improve this answer
3
  • Do you know of a official documentation about it? I tried to find, but to no avail (I could simulate it tough). I'm using nginx as a reverse proxy (to services that I don't own) with basic auth for safety, but it seems it's not so safe anymore (unless the application itself use CSRF tokens or verify the origin header, which is not in my hands). I would like an official documentation because it could point to some approach to avoid (or mitigate) the chances of CSRF in this case (or maybe something that could be done at the nginx side).
    – Lucas Basquerotto
    Jul 7, 2020 at 18:05
  • @LucasBasquerotto: "Do you know of a official documentation about it?" - there is no official documentation for a feature (restrict Authorization) which does not exist. Basic Authentication is not a good idea in the first place since there is no way to log out or to expire sessions. CSRF mitigation is similar to cookie based authentication where the browser does not support any same-site attribute.
    – Steffen Ullrich
    Jul 7, 2020 at 18:16
  • "Basic Authentication is not a good idea in the first place since there is no way to log out or to expire sessions" In this case I will use basic auth for private services inside a private network. The main security vulnerability that I see is CSRF (it can bypass the firewall, because the request is done by the user/victim browser). If the browsers supported a way to disable non-GET requests to other sites it would work too. In any case, it seems there is no way to do that for basic auth, so I will accept your answer.
    – Lucas Basquerotto
    Jul 7, 2020 at 19:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .