67

Try to think of it this way: When you are logging in to any website using SSL, you are most likely passing password in plain-text over HTTPS (for eg GMail). The only difference that Basic-Auth makes is that username/password is passed in the request headers instead of the request body (GET/POST). As such, using basic-auth+https is no less or more secure ...


12

You note the need for authenticating the client and ask about the security of HTTP basic auth, over SSL. This is what SSL was designed for and will work fine so long as the password is a good one. If you're really setting this up for just a single client, that is easy to ensure by picking a long random password, e.g. 12 characters using a good source of ...


7

If you aren't using HTTPS then this information could easily be picked up by anyone sitting between you and your server and reused. If you are using SSL/HTTPS to encrypt the link, then you should be fine.


3

I am using this myself for many things, and as long as you don't ignore any TLS warnings from the browser you should be good. TLS works below HTTP, so any data transmitted through HTTP will be encrypted. It'll be as secure as submitting any password form. Instead of using a self-signed certificate though, I would suggest using Let's Encrypt. They provide ...


2

Another argument not mentioned (I guess) so far is the fact that many mobile devices such as smart phones do not let the user check the certificate when doing basic auth over HTTPS in the browser. That means that unlike with forms based auth you cannot bypass the basic auth popup which is a modal dialog on most mobile platforms to check the certificate ...


1

ZAP supports HTTP basic authentication natively, so you wont need to use Zest in this case. If you know that an app uses basic auth then you can set that up via the API. However I recommend that you start by using the ZAP desktop as this is much easier to use when debugging issues. For specific help with this its probably quicker to ask on the ZAP User Group:...


Only top voted, non community-wiki answers of a minimum length are eligible