2 ms·
There is also UI/UX to consider, e.g. no "I forgot my password" button in the basic auth dialog. So you have to rely on error page handling this case and if you
by okket 8y ago
There is also UI/UX to consider, e.g. no "I forgot my password" button in the basic auth dialog. So you have to rely on error page handling this case and if you have to go to this lengths, why not scrap the whole basic auth in the first place?
Further, you can't show flashy banners with questionable by profitable content during a basic auth dialog...
- boramalper 8y agoOh yes, UX is definitely a concern, but I was more worried about the security implications of it. Also, users are so accustomed to form-based logins that a modal dialog from the browser might even freak some out. Now thinking about it, I think two-factor authentication would also be impossible with Basic Auth, and surely that’s a legit security concern. For the record, my app is a small self hosted solution so changing your password is as simple as updating a credentials file and sending a SIGHUP to the daemon.
- eb0la 8y agoWith http cretentials, if you change your password while authenticated you'll get a 403 . Form+Session[Cookie||LocalStorage] is much more flexible.
- boramalper 8y agoWouldn't refresh work?
- fulafel 8y agoThe user can press cancel, or give the wrong password, and then the application can serve a custom page containing a "forgot password" button.
- eb0la 8y agoI agree. If I remember well, in old browsers (netscape 4.x, IE 3) when you had enough bad login attempts, you got stuck on the 403 forbidden page and you had to restart the whole browser just to try to login again. Of course you could have a 403 page with the I fogot my password mechanics; but that was very uncommon. Some servers (Apache) would allow you to do that but that was an exception, not the rule.