4 ms·
I think the security of basic auth killed it off. 1. Usernames and passwords sent clear text in URLs. 2. Hijacking is worse than cookie hijacking because you
by eterm 4y ago
I think the security of basic auth killed it off.
1. Usernames and passwords sent clear text in URLs.
2. Hijacking is worse than cookie hijacking because you get the permanent credentials with no way to force session invalidation
3. Credentials would be cached (and visible) in browser history
It was a byproduct of the early web and isn't fit for purpose.
- yamtaddle 4y agoCredentials are sent in headers, and http-auth supports a bunch of schemes other than basic. Browsers have (shitty) UI for taking the username and pass, you don't have to put it in the address bar (and that's been discouraged for years and years). There's no reason whatsoever the feature couldn't have been improved and promoted over the years such that there would rarely be a reason to use anything else. The Web's failure here has been a remarkably expensive misstep for the software economy.
- qbasic_forever 4y agoThere's no concept of forgot my password or ID with browser auth. People tried using it years and years ago and it just never evolved into something usable by the general public.
- yamtaddle 4y agoYes, it definitely should have been maintained and improved over the years.