5 ms·
This is equivalent to basic HTTP authentication. If used over TLS it's safe-ish: The real issues arise from servers logging HTTP requests/headers and whatnot in
by matthewaveryusa 4y ago
This is equivalent to basic HTTP authentication. If used over TLS it's safe-ish: The real issues arise from servers logging HTTP requests/headers and whatnot in plaintext. The two benefits of using a session over the raw password are that:
1) sessions are typically scoped in time, and
2) if the session is revealed, it can't be used for credential stuffing (using the same credentials on a different website to see if the password was used there too.)
Having said that I'm not being an apologist: The design should be better
- eatonphil 4y ago> HTTP authentication Just clarifying, do you mean basic auth with the `Authorization: Basic base64(username : password)` scheme?
- matthewaveryusa 4y agoyeah -- updated.
- blenderdt 4y agoWhich can also be sent in the URL like: https://username:password@example.com https://username:password@example.com But this is of course even worse because most servers log this. Headers are not often logged.
- VWWHFSfQ 4y agoI'm fairly certain that's just a convenience. The HTTP client will transform that into basic auth header in the actual request
- blenderdt 4y agoInteresting. I wonder what really happens because I sometimes use this when I need to send an Authorization header to a location behind basic auth. As far as I know only Nginx accepts multiple Authorization headers.
- VWWHFSfQ 4y agoJust testing it out with netcat, I can see the client is sending it as regular basic auth header: $ nc -l 127.0.0.1 8000 GET / HTTP/1.1 Host: 127.0.0.1:8000 User-Agent: python-requests/2.22.0 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive Authorization: Basic dGVzdDp0ZXN0 >>> requests.get("http://test:test@127.0.0.1:8000")
- eatonphil 4y agoAnd if you also pass an Authorization header it just drops the basic auth header (tested against a mirror server): $ curl http://user:pass@localhost:8080 GET / HTTP/1.1 Host: localhost:8080 User-Agent: curl/7.79.1 Accept: */* Authorization: Basic dXNlcjpwYXNz $ curl -H 'Authorization: Token blobbity' http://user:pass@localhost:8080 GET / HTTP/1.1 Host: localhost:8080 User-Agent: curl/7.79.1 Accept: */* Authorization: Token blobbity
- tinus_hn 4y agoMost servers obviously by default do not log the password, all of the ones I checked do not even have a way to do so.
- lillecarl 4y ago"Use of the format "user:password" in the userinfo field is deprecated." https://www.ietf.org/rfc/rfc3986.txt https://www.ietf.org/rfc/rfc3986.txt FYI
- ptx 4y agoPerformance would be another benefit, wouldn't it? Password hashing algorithms are deliberately slow, so doing it for every request adds some overhead compared to doing it once and establishing a session ID. (Assuming that the passwords are hashed on the server.)
- jaywalk 4y agoNobody's hashing a password on every request. In this case, the cookie is used for a (very shoddily implemented) "Remember Me" feature, so the user doesn't have to login to the website every time they use it.
- ptx 4y agoIf you're sending the password in plaintext with every request and using it for authentication (e.g. using HTTP basic authentication) you're essentially logging in with every request, so you will have to hash the password in order to validate it, unless you're storing it in plaintext on the server as well.
- Fatnino 4y agoYou have a session like normal websites do and ignore the plaintext password in the cookie. Only the login page ever uses the cookie stored password in the rare instance the user got logged out by mistake. Basically, Lenovo reimplemented a basic browser feature that is supposed to just work locally and made it stupid.
- ptx 4y agoI see, thanks for clarifying. My reply was in reference to the "benefits of using a session over the raw password" and HTTP basic authentication more generally, so if Lenovo are using sessions it doesn't apply in this particular case.