Why does your API still use HTTP Basic Auth?
swaggadocio.com
Why does your API still use HTTP Basic Auth?
1–10 of 136 posts
Re: Why does your API still use HTTP Basic Auth?
#2Agree that the practice of just redirecting http requests to https is a bad idea.
Hope this can help raise awareness why it's bad.
Re: Why does your API still use HTTP Basic Auth?
#3So if you offer a https only API and anyone makes the mistake of using http instead, what should be the response of your system? A simple error message with 404 code and without special/identifying headers?
Re: Why does your API still use HTTP Basic Auth?
#4So if you offer a https only API and anyone makes the mistake of using http instead, what should be the response of your system? A simple error message with 404 code and without special/identifying headers?
The main problem isn't the response, the problem is that on the initial request, the insecure password will be sent in plaintext.
Re: Why does your API still use HTTP Basic Auth?
#5So if you offer a https only API and anyone makes the mistake of using http instead, what should be the response of your system? A simple error message with 404 code and without special/identifying headers?
From the article:
close port 80 on your API hostRe: Why does your API still use HTTP Basic Auth?
#6So if you offer a https only API and anyone makes the mistake of using http instead, what should be the response of your system? A simple error message with 404 code and without special/identifying headers?
The main problem isn't the response, the problem is that on the initial request, the insecure password will be sent in plaintext.
[deleted]
Re: Why does your API still use HTTP Basic Auth?
#7Obviously it is user agent failure. Why would you want transmit private information clear text?
Edit: File bug to browser makers. Personally use http proxy to remove auth and cookies from insecure traffic.
Re: Why does your API still use HTTP Basic Auth?
#8So if you offer a https only API and anyone makes the mistake of using http instead, what should be the response of your system? A simple error message with 404 code and without special/identifying headers?
The proper response should be to expire the insecurely-sent passwords.
Re: Why does your API still use HTTP Basic Auth?
#9Isn't this is a problem with the client, curl in this case? According to the spec:
> HTTP provides a simple challenge-response authentication mechanism which may be used by a server to challenge a client request and by a client to provide authentication information.
The client should make two requests. The first with no credentials to see if the resource is protected (the challenge part). The server will then respond with a 401 Unauthorised status and a WWW-Authenticate header indicating what authentication to use. The client will then make another request with the given authentication.
The insecurity is caused by curl not doing this challenge response, it is just sending the credentials straight away.
Re: Why does your API still use HTTP Basic Auth?
#10I like HTTP APIs that use basic auth over SSL. Why? Because as the blogpost demonstrates nicely, curl is a wonderful tool to test, demo and debug things.
As soon as you introduce e.g. MACs to the mix, you can forget about most unix-y commandline tools.
I think we can all agree that there are better options when it comes to authentication, but I'd rather have something I can work with easily than worry about that tiny amount of possible "plain http pre redirect" mistakes.
What about using http digest auth as a middle ground? It's still curl compatible and a tiny bit more secure.