Questions tagged [http-basic-auth]
HTTP basic auth is an authentication mechanism used for websites over the HTTP protocol. It is commonly recogniced by a browser password prompt.
15
questions
0
votes
0answers
23 views
IIS CMS access web service
We are creating a new web site and it’s using a CMS that will connect to a internal web service that will connect to a sql database. The cms will be in the DMZ and the web service will be in the ...
0
votes
1answer
77 views
HTTP Basic Auth and CSRF
I would like to know if the Basic Authentication header for site A can be sent from site B when trying to access site A for non-GET requests (which would make the site vulnerable to CSRF attacks).
I ...
0
votes
1answer
293 views
sqlmap: Test injection in Basic Authentication?
I have been trying to make sqlmap test the username parameter in a fake login page that uses basic authentication. However I cannot make it test the Authentication header via the asterisk trick:
...
1
vote
1answer
62 views
Basic Auth exposed to ISP/DNS?
Would someone using basic authentication in a URL such as
https://username:password@example.com
have their credentials be visible to their ISP or DNS?
1
vote
1answer
86 views
What are the security risks of basic authorization in SOAP requests?
What are the security risks of basic authorization in SOAP requests?
I know that the username and password are concatenated and sent in Base64 in an HTTP header on every subsequent request, but it is ...
0
votes
0answers
44 views
Is there a way to add an HTTP header before using a metasploit module
I'm quite confused and I didnt find a way to figure how to add a custom header or for exemple an Authentication Header before using/running a module on metasploit.
My question is: there is a way to ...
0
votes
0answers
76 views
HTTP Basic Authentication vs. obscure filename [duplicate]
I'm setting up a service which allows a single 3rd party to access a file over HTTPS. The only security mechanism the 3rd party supports is Basic Authentication.
To reduce complexity, I was going to ...
0
votes
0answers
144 views
What is the difference between using an auth header and the request body to send credentials?
I have an API that uses JWT token-based authentication. In order to get a short-lived token, the client first calls a /Token endpoint, passing username and password in the body of the request. As I ...
35
votes
1answer
3k views
Why would image resources loaded from different origins triggering HTTP authentication dialogs be harmful?
From https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication, it says:
A potential security hole that has recently been fixed by browsers is
authentication of cross-site images. From ...
0
votes
2answers
579 views
Any downside to using basic authentication over HTTPS in addition to native authentication?
Can basic authentication over HTTPS do any harm on a personal one-user server if used in addition to native authentication provided by individual web applications?
0
votes
1answer
99 views
Implementing generic login for Zap
I need to build an automated tool that will be able to login to any website supporting basic auth to perform an authenticated scan with OWASP Zap (credentials provided). Here is what I have in mind: ...
5
votes
1answer
659 views
Firefox not deleting HTTP Basic authentication credentials although being instructed to do so
On one of my web servers, I have set up a password-protected directory using the well-known .htaccess / .htpasswd mechanism. The web server is run by Apache 2.4.10 under Debian jessie, if that matters....
11
votes
3answers
401 views
How to prevent popping up a login dialogue using a malicious hotlinked image and HTTP Basic Auth header?
While using Firefox to browse my forums, I noticed that a malicious user posted an image (via hotlinking, not by uploading to my server) with the extension .png which complies with the forum rules (...
2
votes
1answer
1k views
HTTP Basic Auth is enough?
I have WebSVN, Gitlab and phpMyAdmin hosted on my dev server. Now, all of it, I password protect the pages (not their individual login) using HTTP Basic Auth, is this the best practice that I can do?
348
votes
9answers
211k views
Is BASIC-Auth secure if done over HTTPS?
I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used.
Can this be considered secure?
