Collaborate Disseminate
I have an API that uses JWT token-based authentication. In order to get a short-lived token, the client first calls a /Token endpoint, passing username and password in the body of the request. As I understand it, this is a st… Continue reading What is the difference between using an auth header and the request body to send credentials?
From https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication, it says:
A potential security hole that has recently been fixed by browsers is
authentication of cross-site images. From Firefox 59 onwards, image
… Continue reading Why image resources loaded from different origins triggers HTTP authentication dialogs would be harmful?
Can basic authentication over HTTPS do any harm on a personal one-user server if used in addition to native authentication provided by individual web applications?
TLS/PKI guarantees that the domain name as normally displayed in the URL in a browser is the one that is being communicated with. Which is completely useless in practice because users do not actually confirm that the domain … Continue reading Using Digest Authentication to fix TLS/PKI? Patents?
I need to build an automated tool that will be able to login to any website supporting basic auth to perform an authenticated scan with OWASP Zap (credentials provided). Here is what I have in mind: using python requests libr… Continue reading Implementing generic login for Zap
I’m developing REST APIs and would like to know if Basic Authentication will be enough to secure them, or if I should be looking into other authentication methods, like OAuth2. My APIs are setup to only be accessed by a limit… Continue reading REST API Basic Authentication Use Case
On one of my web servers, I have set up a password-protected directory using the well-known .htaccess / .htpasswd mechanism. The web server is run by Apache 2.4.10 under Debian jessie, if that matters. The relevant snippet from the virtual… Continue reading Firefox not deleting HTTP Basic authentication credentials although being instructed to do so
While using Firefox to browse my forums, I noticed that a malicious user posted an image (via hotlinking, not by uploading to my server) with the extension .png which complies with the forum rules (allowing only .png, .gif, …. Continue reading How to prevent popping up a login dialogue using a malicious hotlinked image and HTTP Basic Auth header?
I have WebSVN, Gitlab and phpMyAdmin hosted on my dev server. Now, all of it, I password protect the pages (not their individual login) using HTTP Basic Auth, is this the best practice that I can do?
I’m making a REST-API and it’s straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used.
Can this be considered secure?