I am using HTTP Basic Auth to authenticate the user. Once authenticated, I set req.session.loggedIn = true on the server-side. If a user makes requests after being logged in, for security purposes, should I just check the session loggedIn value or send the basic auth header on each request and then verify credentials on each request on my backend?
3More information is needed. What language/framework is this? Is it setting a cookie when the user becomes logged in?– multithr3at3dSep 24, 2020 at 17:02
As mti2935 mentions, the Basic Auth header is automatically sent by the browser with every request. That means setting a session cookie is redundant.
However, usage of HTTP Basic Auth should be discouraged, as is discussed in this answer.
1+1. In addition to the points made in the thread referenced in the answer, HTTP Basic Authentication was not designed to provide a method for logging the user out. See stackoverflow.com/questions/233507/…– mti2935Sep 25, 2020 at 12:32
If your variable, req.session.loggedIn is client-side controllable, then you have a gaping authentication flaw.
Assuming that is the case -- you need to generate a unique session ID after successful login. When a user requests a page, you will check if the session ID is valid.
It's worth noting: we want to reduce transmittance of credentials wherever possible. Generally speaking, session ID usually less valuable than credentials.