3 ms·
Basic auth is only OK if you don't have :80 open. Clients will send the creds over the clear to :80. It doesn't matter if you reply with a 400, the creds are al
by sjtgraham 9y ago
Basic auth is only OK if you don't have :80 open. Clients will send the creds over the clear to :80. It doesn't matter if you reply with a 400, the creds are already compromised at that point.
- JimDabell 9y agoEven if you don't have :80 open, that doesn't mean there isn't a MITM that would accept the connection instead of you.
- willstrafach 9y agoAs long as https:// https:// prefix is used, this is not true, MITM cannot downgrade that.
- beaconstudios 9y agoplus a HSTS header for any type-in traffic.