3 ms·

Huh? HTTP Basic Authentication doesn't use PBKDF2 (or any other key derivation function).

• billpg 5y ago
  The server will have a clear-text (leaving the base64 to one side) password in the HTTP request and a PBKDF2 (or similar) token loaded from the user database. Unless you store the user's password in the clear inside your user database, but will have other security issues.
  • Denvercoder9 5y ago
    Ok, but if you handle that in the app, it doesn't get invoked for CSS/JS/images/etc requests.
    • lucb1e 5y ago
      I don't know how you got to this being used for an app, but in most cases users will just be using a normal web browser and they will be requesting those resources (perhaps with etag/if-modified-since) on each request.
      • Denvercoder9 5y ago
        App doesn't exclusively refer to mobile applications, in this case I meant the web application.
  • deleted 5y ago
    [deleted]