4 ms·

It prevents delegation, though, which is an important use case for some APIs. As in "I want this third-party service to read my calendar from another server, bu

by euyyn 9y ago

It prevents delegation, though, which is an important use case for some APIs. As in "I want this third-party service to read my calendar from another server, but I don't want it to hijack my account, and I want to be able to revoke its access later on."

thwarted 9y ago
That's an implementation detail of how the credentials are created, managed, interpreted by the server, and their use reported on to the user, none of which is specific to the credentials transport or encoding, which is all basic auth is. The thing to be aware of is how different HTTP clients, specifically user-interactive browsers, use (apply and remember) the credentials.
- vetinari 9y ago
  And if you dig deeper in this direction, you will find yourself Greenspunned into Kerberos.
- euyyn 9y ago
  If you reinterpret Basic auth as "send a token that's not the user's password in the Authorization header", you're just doing OAuth 2 but writing "Basic" instead of "Bearer".