I'm setting up a home HTTP server which can send and receive JSON data to/from different clients (Android and iPhone apps).
I'd like to allow access only to certain users and I'm considering using a simple username/password mechanism, as setting up client certificates seems a bit of an overkill for this small project.
Of course I can't send clear passwords from the client to the server on plain HTTP, otherwise anyone with wireshark/tcpdump installed could read it. So, I'm thinking about the following mechanism:
- The HTTP server can be set up as HTTPS server
- The server also has username/password database (passwords might be saved with bcrypt)
- The client opens the HTTPS connection, it authenticates the server (so a server certificate is needed) and after exchanging the master key, the connection should be encrypted.
- The client sends the username/password in clear to the server
- The server runs bcrypt on the password and compares it with the one stored in the database
Is there any problem with this kind of configuration? The password should be safe since it's sent on an encrypted connection.