3 ms·
with basic authentication, you cannot embed the decryption key into the url via a hash fragment. This means you must have a secondary channel to communicate to
by chii 4y ago
with basic authentication, you cannot embed the decryption key into the url via a hash fragment.
This means you must have a secondary channel to communicate to the user about the password, and the server must also know the password.
So depending on your use-case, the basic auth isn't suitable. For example, mega : https://en.wikipedia.org/wiki/Mega_(service) https://en.wikipedia.org/wiki/Mega_(service) , in which you want to ensure that the decrypted data is _not_ accessible to the server, so the key is not stored nor sent to the server!
- rvnx 4y agoIn a real-life scenario, the server can access the key and collect it back (just farming location.hash)
- deaddodo 4y agoSure you can, it’s been built-in to the HTTP spec since RFC1738[1]. You just do: //<user>:<pass>@<url>[:<port>][/<location>]/ It doesn’t work on IE classic, but should still be perfectly valid on Chrome, Safari, Firefox, etc. 1 - https://www.ietf.org/rfc/rfc1738.txt https://www.ietf.org/rfc/rfc1738.txt