4 ms·
What about for SSL-based APIs? it seems a pretty optimal choice for those.
by mjw 16y ago
What about for SSL-based APIs? it seems a pretty optimal choice for those.
- tptacek 16y agoI don't think it is, for two reasons: (1) For most large apps, you're not really SSL in the provider's own network, so there's always the cross-app risk if something horrible happens. (2) It's forcing app-to-app, business-to-business authentication into a username/password mold that doesn't many any real sense; a 128 bit random key (or an SSL client cert) makes more sense anyways. Against those two problems --- which are marginal, I concede --- HTTP Basic offers... exactly what advantage? I don't see it.