3 ms·

> Does even anybody remember the good old HTTP basic acess authentification? This is one of the most accessible ways of protecting ressources, it can be consume

by megous 7y ago

> Does even anybody remember the good old HTTP basic acess authentification? This is one of the most accessible ways of protecting ressources, it can be consumed by any HTTP client (!), and it is just reduced to the basic. Yes! I recently used an e-shop that uses HTTP auth for user accounts. It was a bit unsettling, when the browser asked me for login credentials. :)

heavenlyblue 7y ago
It's also quite disappointing that I can't use my 1Password vault when a website asks for my HTTP password via a standard dialog in Firefox. PS: I am using Ubuntu so I can't use 1Password as a standalone application; but how does it happen that a website is perfectly capable of blocking my interaction with the browser? Why doesn't Firefox ask for the password as part of the actual webpage instead? Hadn't tried it in other browsers - does it work at all?
- dylz 7y ago
  In this case, the u/p needs to be sent along with the request - which means it needs to be asked for by the browser before the request to the site is ever sent..
  - heavenlyblue 7y ago
    No, I mean just show a customised page for 403 that also has a username/password that you could put in and log in. The cross-browser modal dialog is entirely anti-Ux.
- silverwind 7y ago
  Bitwarden is able to auto-fill basic auth dialogs in Firefox, but only if there is only a single entry for the page in store. Thought, sometimes it sometimes does not work. I do wish Mozilla would finally do away with the modal auth dialog and use in-tab content that extensions can interact with.
smartmic 7y ago
I just set up my own Git central using HTTP basic auth (with cgit and Gitolite). It is refreshingly simple and also looks good in text-based browsers. https://github.com/h2o/h2o/wiki/Hosting-private-and-public-repositories-with-cgit-and-Gitolite https://github.com/h2o/h2o/wiki/Hosting-private-and-public-r...
- megous 7y ago
  Yup, I also use basic auth for in-development websites for my customers. It's just a few lines in nginx, and very flexible. The website doesn't even need to know.

by megous 7y ago

heavenlyblue 7y ago

It's also quite disappointing that I can't use my 1Password vault when a website asks for my HTTP password via a standard dialog in Firefox. PS: I am using Ubuntu so I can't use 1Password as a standalone application; but how does it happen that a website is perfectly capable of blocking my interaction with the browser? Why doesn't Firefox ask for the password as part of the actual webpage instead? Hadn't tried it in other browsers - does it work at all?

dylz 7y ago
In this case, the u/p needs to be sent along with the request - which means it needs to be asked for by the browser before the request to the site is ever sent..
- heavenlyblue 7y ago
  No, I mean just show a customised page for 403 that also has a username/password that you could put in and log in. The cross-browser modal dialog is entirely anti-Ux.
silverwind 7y ago
Bitwarden is able to auto-fill basic auth dialogs in Firefox, but only if there is only a single entry for the page in store. Thought, sometimes it sometimes does not work. I do wish Mozilla would finally do away with the modal auth dialog and use in-tab content that extensions can interact with.

smartmic 7y ago

I just set up my own Git central using HTTP basic auth (with cgit and Gitolite). It is refreshingly simple and also looks good in text-based browsers. https://github.com/h2o/h2o/wiki/Hosting-private-and-public-repositories-with-cgit-and-Gitolite https://github.com/h2o/h2o/wiki/Hosting-private-and-public-r...

megous 7y ago
Yup, I also use basic auth for in-development websites for my customers. It's just a few lines in nginx, and very flexible. The website doesn't even need to know.