During an engagement, i have been asked by a client to explain (with the use of one or more examples) why they must update their website authentication mechanism, as they are currently using HTTP Basic-Authentication and how it can be dangerous for the security of a system

  • 5
    It's your client and you made the recommendation - why did you recommend it?
    – user163495
    Apr 21 at 12:29
  • 1
    @MechMK1 iam not the one who designed the system, i didn't recommend it Apr 21 at 15:22
  • @SteffenUllrich's linked answer answers the main points. I would also the lack of support for 2FA/MFA. Apr 21 at 19:53
  • 1
    If I remember correctly basic auth in a web browser has one large disadvantage: it is impossible to log out. The only way to do so it to close the web browser.
    – Robert
    Apr 21 at 20:32

1 Answer 1


One possible issue in the current scheme: the user passwords may be stored in clear text in the backend, if that is the case then this is the "problem" you'll want to fix. Hash them, salt them. The transport is only part of the problem.

Also consider alternatives like client certificates.

Not the answer you're looking for? Browse other questions tagged or ask your own question.