4 ms·
I didn't get past the Basic Auth part where the author said the cons were both that you have to send credentials with every request and that there was no way to
by IX-103 6y ago
I didn't get past the Basic Auth part where the author said the cons were both that you have to send credentials with every request and that there was no way to log out.
For one, both of those cannot simultaneously be true (as omitting credentials becomes equivalent to logging out).
In addition, all of the methods described require credentials with every request. Some just are stored in the cookie jar instead of the browser's auth handler. But whether it ends up in an auth header or a cookie header, it's still part of the HTTP request.
- aaronharnly 6y agoYes, though I suppose they might have meant the inclusion of permanent credentials rather than a session key or temporary token?
- jimktrains2 6y agoThey may have meant that there is no way to tell the browser to stop sending credentials.
- hunter2_ 6y agoI agree that this is what the author meant. But is it a true statement? With cookie-based auth, the user can't (except for digging deep into the settings / dev tools) make the browser stop sending a particular cookie either, but the server (or script) can be programmed to ask the browser to remove a specific cookie. Is the same not true for basic auth, i.e., is there no response header the server can send that results in the browser ceasing to include the basic auth creds thereafter?
- 1vuio0pswjnm7 6y ago"With cookie-based auth, the user can't (except for digging into the settings / dev tools) make the browser stop sending a particular cookie either." I am a user and I can easily stop the browser from sending a particular cookie, without digging into settings or dev tools. This is assuming the operating system lets me run whatever software I choose.
- hunter2_ 6y agoIn your case, I'm quite certain you could stop sending basic auth credentials just as easily as you could stop sending a particular cookie. For the case of a less sophisticated setup, which is to say mainstream browsers with no extensions and users who want to achieve logout by using some link/button rendered inside the viewport, is there a way to convey the logout intent [to the server such that no more than one round trip later] or [to the browser without closing it such that] the browser is no longer including basic auth credentials? If it's not possible, that's pretty silly.
- jimktrains2 6y agoIt is pretty silly. With cookies, the site can tell the browser to drop the cookie, change the cookie, or just consider the cookie as unauthenticated going forward. With basic auth the site has no control, and the user has no control. How basic auth works is a design choice that still baffles me.
- 1vuio0pswjnm7 6y agoThe setup I use is not sophisticated by HN standards, but it does not in any way rely on the application, e.g., the web browser. I do not use the browser itself to try to control the browser's activity. I do not use browser settings, dev tools, extensions, etc., which seem to be the more popular choice. As I mentioned in the original comment, some websites, like banks for example, will log the user out after a period of insactivity. Whereas tech companies, always trying to collect more data, may encourage users to "stay logged in", ideally forever. Having session cookies expire could be an option that users could control. The user could choose to have the site log her out after x minutes of inactivity, or some such. The site could agree to "expire" the session cookie on the server side such that it could not be used again. How would the user signal her chosen option to the site. I leave that to the reader. Perhaps an HTTP header sent with the initial log in request: Session-Cookie-Max-Age: [seconds]
- nmadden 6y agoRight - there is no way for the server to tell a browser to stop sending basic auth credentials.
- JosefAssad 6y agoWell, not explicitly. But you can respond with a set-cookie header for the same session id, with an expiry in the past. Browsers will purge expired cookies.
- nmadden 6y agoFor cookies... not for Basic Auth.