Questions tagged [http-basic-auth]

HTTP basic auth is an authentication mechanism used for websites over the HTTP protocol. It is commonly recogniced by a browser password prompt.

Filter by
Sorted by
Tagged with
308
votes
9answers
177k views

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?
36
votes
1answer
3k views

Why would image resources loaded from different origins triggering HTTP authentication dialogs be harmful?

From https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication, it says: A potential security hole that has recently been fixed by browsers is authentication of cross-site images. From ...
11
votes
3answers
391 views

How to prevent popping up a login dialogue using a malicious hotlinked image and HTTP Basic Auth header?

While using Firefox to browse my forums, I noticed that a malicious user posted an image (via hotlinking, not by uploading to my server) with the extension .png which complies with the forum rules (...
3
votes
1answer
133 views

Firefox not deleting HTTP Basic authentication credentials although being instructed to do so

On one of my web servers, I have set up a password-protected directory using the well-known .htaccess / .htpasswd mechanism. The web server is run by Apache 2.4.10 under Debian jessie, if that matters....
2
votes
1answer
1k views

HTTP Basic Auth is enough?

I have WebSVN, Gitlab and phpMyAdmin hosted on my dev server. Now, all of it, I password protect the pages (not their individual login) using HTTP Basic Auth, is this the best practice that I can do?
0
votes
1answer
61 views

Implementing generic login for Zap

I need to build an automated tool that will be able to login to any website supporting basic auth to perform an authenticated scan with OWASP Zap (credentials provided). Here is what I have in mind: ...
0
votes
2answers
72 views

Any downside to using basic authentication over HTTPS in addition to native authentication?

Can basic authentication over HTTPS do any harm on a personal one-user server if used in addition to native authentication provided by individual web applications?
0
votes
0answers
38 views

REST API Basic Authentication Use Case

I'm developing REST APIs and would like to know if Basic Authentication will be enough to secure them, or if I should be looking into other authentication methods, like OAuth2. My APIs are setup to ...