Questions tagged [http-basic-auth]

HTTP basic auth is an authentication mechanism used for websites over the HTTP protocol. It is commonly recogniced by a browser password prompt.

Filter by
Sorted by
Tagged with
1 vote
2 answers
170 views

Using asymmetric encryption as authentication over HTTP?

I've read questions targeting the usage of basic authentication over HTTPS. Since the connection is already secure, except e.g. a compromised certificate, communication should be rather safe. But I ...
David Fischer's user avatar
0 votes
0 answers
13 views

How to detect web account vulnerability [duplicate]

I know I might take a lot of flack for asking this basic question, but I hope you'll be patient with me. I was looking at a few websites and analyzing the payload when sending a POST request to login. ...
Robin Sage's user avatar
1 vote
0 answers
553 views

Basic authentication after mTLS?

I work for a software company and I'm currently doing research for an enhancement request. Essentially we have a application client which talks to a rest end point which is authenticated using basic ...
Errol Neal's user avatar
0 votes
0 answers
444 views

Best secure approach with Basic Auth

Due to several customer reasons our product needs to support Basic Auth as primary authentication mechanism with client's service account. We are using Bcrypt to store customer's password in our DB, ...
Kucera.Jan.CZ's user avatar
7 votes
2 answers
10k views

What are the advantages of using JWT over Basic Auth with Https?

As per my understanding both JWT and Basic Auth used to store login credentials on client side and avoid sessions for better scalability. I understand with Basic Auth login credentials will be sent ...
Arjun's user avatar
  • 171
10 votes
1 answer
2k views

Is basic HTTP proxy authentication secure?

I have been looking for cloud based proxies, and I notice that it's very common to authenticate to a proxy using basic auth over an unencrypted connection. I don't understand why this is considered ...
William Rosenbloom's user avatar
0 votes
0 answers
428 views

Is caching the credentials hash and auth result secure?

I have an API that is handling a lot of volume and is using Basic authorization. This is causing me some performance issues and I'd like to move to token based auth but for various reasons, including ...
user244760's user avatar
0 votes
0 answers
180 views

Server to Server HTTP Authentication

I'm designing an API, and had some quick questions about HTTP authentication and security. The API will involve two web servers, one of which I am the developer of (let's call it Server 1). The server ...
artifc3's user avatar
0 votes
2 answers
844 views

HTTP Basic Auth question

I am using HTTP Basic Auth to authenticate the user. Once authenticated, I set req.session.loggedIn = true on the server-side. If a user makes requests after being logged in, for security purposes, ...
jpj's user avatar
  • 1
9 votes
2 answers
3k views

Should http basic auth passwords be stored hashed serverside?

HTTP basic auth sends credentials un-hashed and unencrypted over the wire, relying on TLS for confidentiality in transit. However, should the password be stored hashed using a standard KDF in the ...
Prime's user avatar
  • 484
0 votes
1 answer
3k views

HTTP Basic Auth and CSRF

I would like to know if the Basic Authentication header for site A can be sent from site B when trying to access site A for non-GET requests (which would make the site vulnerable to CSRF attacks). I ...
Lucas Basquerotto's user avatar
5 votes
3 answers
10k views

Can sqlmap test for SQL injection in Basic Authentication?

I have been trying to make sqlmap test the username parameter in a fake login page that uses basic authentication. However I cannot make it test the Authentication header via the asterisk trick: ...
chefarov's user avatar
  • 174
1 vote
1 answer
207 views

Basic Auth exposed to ISP/DNS?

Would someone using basic authentication in a URL such as https://username:[email protected] have their credentials be visible to their ISP or DNS?
WorseDoughnut's user avatar
1 vote
1 answer
523 views

What are the security risks of basic authorization in SOAP requests?

What are the security risks of basic authorization in SOAP requests? I know that the username and password are concatenated and sent in Base64 in an HTTP header on every subsequent request, but it is ...
user187205's user avatar
  • 1,283
0 votes
0 answers
190 views

HTTP Basic Authentication vs. obscure filename [duplicate]

I'm setting up a service which allows a single 3rd party to access a file over HTTPS. The only security mechanism the 3rd party supports is Basic Authentication. To reduce complexity, I was going to ...
Alastair McCormack's user avatar
35 votes
1 answer
3k views

Why would image resources loaded from different origins triggering HTTP authentication dialogs be harmful?

From https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication, it says: A potential security hole that has recently been fixed by browsers is authentication of cross-site images. From ...
Rick's user avatar
  • 1,027
1 vote
2 answers
5k views

Any downside to using basic authentication over HTTPS in addition to native authentication?

Can basic authentication over HTTPS do any harm on a personal one-user server if used in addition to native authentication provided by individual web applications?
Mihai Nagy's user avatar
0 votes
1 answer
227 views

Implementing generic login for Zap

I need to build an automated tool that will be able to login to any website supporting basic auth to perform an authenticated scan with OWASP Zap (credentials provided). Here is what I have in mind: ...
postoronnim's user avatar
6 votes
3 answers
3k views

Firefox not deleting HTTP Basic authentication credentials although being instructed to do so

On one of my web servers, I have set up a password-protected directory using the well-known .htaccess / .htpasswd mechanism. The web server is run by Apache 2.4.10 under Debian jessie, if that matters....
Binarus's user avatar
  • 557
11 votes
3 answers
503 views

How to prevent popping up a login dialogue using a malicious hotlinked image and HTTP Basic Auth header?

While using Firefox to browse my forums, I noticed that a malicious user posted an image (via hotlinking, not by uploading to my server) with the extension .png which complies with the forum rules (...
user3196332's user avatar
2 votes
1 answer
2k views

HTTP Basic Auth is enough?

I have WebSVN, Gitlab and phpMyAdmin hosted on my dev server. Now, all of it, I password protect the pages (not their individual login) using HTTP Basic Auth, is this the best practice that I can do?
Leandro Garcia's user avatar
432 votes
9 answers
306k views

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?
Morten's user avatar
  • 4,473