Linked Questions

26 votes
3 answers
16k views

What are the disadvantages of implementing HTTP authentication in a web application? [duplicate]

I know that there are different types of authentication mechanisms available. One among them is the HTTP authentication. What is the danger in using this method compared to other methods?
Anandu M Das's user avatar
  • 2,057
3 votes
0 answers
635 views

How secure is HTTP basic authentication over SSL? [duplicate]

Possible Duplicate: Is BASIC-Auth secure if done over HTTPS? I want to set up a web server on a computer at home which will basically do no more than send the browser a file which contains ...
Steven Lu's user avatar
  • 967
2 votes
1 answer
250 views

Is it secure to store confidential data on basic HTTPS AUTH? [duplicate]

It's a website backend. Since it will only be accessed by two persons, is there any disadvantage on using basic http auth? The website is under https. edit: as the title points, there's confidential ...
izuna's user avatar
  • 23
34 votes
9 answers
14k views

Can a HTTPS connection be compromised because of a rogue DNS server

If I'm visiting (just a desktop PC, client side) a site that has a valid HTTPS cert/connection, that can it be compromised if I'm using a rogue DNS server (not deliberately, I'm concerned about an ...
LanceBaynes's user avatar
  • 6,279
30 votes
3 answers
28k views

Is HTTPS and Basic Authentication secure enough for banking webservices (RESTful)?

I have been reading about SSL/TLS for the last few days and looks like it has never been practically cracked. Given SSL/TLS is used for all communications between client application and the server, ...
dnang's user avatar
  • 655
8 votes
2 answers
5k views

Is DIGEST-MD5 secure if done over HTTPS?

If the DIGEST-MD5 negotiation is done over an HTTPS connection instead of HTTP, does that prevent this list of disadvantages from Wikipedia?: Digest access authentication is intended as a security ...
Charles Offenbacher's user avatar
1 vote
1 answer
6k views

Why can I see the Basic Auth credentials in plaintext when using SSL

I just read this about the security about Basic Authentication over SSL: Is BASIC-Auth secure if done over HTTPS? And I don't get it. I just installed ProxyDroid (http proxy) on my rooted android ...
derFunk's user avatar
  • 121
2 votes
3 answers
5k views

TLS to secure Basic HTTP Auth

Basic Auth, including Bearer tokens, depend on using TLS to prevent eavesdroppers from getting at your sensitive credentials or tokens. But I think there is an Elephant in the room that nobody talks ...
Johan's user avatar
  • 521
0 votes
2 answers
1k views

HTTP Basic Auth question

I am using HTTP Basic Auth to authenticate the user. Once authenticated, I set req.session.loggedIn = true on the server-side. If a user makes requests after being logged in, for security purposes, ...
jpj's user avatar
  • 1
1 vote
0 answers
1k views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
Tholle's user avatar
  • 111
0 votes
1 answer
291 views

Collect XML files from web server with secure authentication

I need to collect XML files from a 3rd party's web server. These XML files are generated by said 3rd party on a daily basis (e.g. data_2015-11-26.xml) and should therefore be fetched at least daily ...
tuesprem's user avatar
2 votes
1 answer
173 views

Password sent over TLS: threats other than TLS compromise?

One of my findings during a security audit was a password, sent as is over the network. As bad as it sounds, this happens only over HTTPS connection. Some authors suggested here that additional ...
Konstantin Shemyak's user avatar
1 vote
1 answer
100 views

Is Web session required for app security?

I understand that the idea of a session was conceived originally to improve user experience with Web applications. I also understand that session implementation can introduce attack vectors if not ...
postoronnim's user avatar