The problem is not with small projects. Who cares if it gets hacked. The problem is with real life SSO. If you used a 100 apps and 1 gets hacked then you have t

The problem is not with small projects. Who cares if it gets hacked. The problem is with real life SSO. If you used a 100 apps and 1 gets hacked then you have to change the other 99 passwords. Sound bad right? That is why you should not use basic auth and use openid connect or similar tech. Sometimes it is a bank, and no SSO involved. It is not well understood but SSL has termination points. E.g. the gateway and each gateway all thru the last layers. SSL becomes vulnerable at these termination points. If basic auth is used, then you just lost a whole lot of cash. Otherwise use challenge response, encrypted passwords within the SSL, and all kind of out of this world tech for risk assessment. Basic auth? Really?