3 ms·
I don't understand the problem mentioned with HTTP Basic, username/password injection into the uri https://username:password@such-n-such.net https://username:p
by feralmoan 13y ago
I don't understand the problem mentioned with HTTP Basic, username/password injection
into the uri https://username:password@such-n-such.net https://username:password@such-n-such.net works just fine if for some reason you can't set the header explicitly. http://tools.ietf.org/html/rfc3986#section-3.2 http://tools.ietf.org/html/rfc3986#section-3.2
- steverb 13y agoUrls aren't encrypted. If you're on an entirely secure network, and you don't mind users seeing user name + password in the url then it might not be a problem.
- feralmoan 13y agoI think the (right) assumption is that http basic auth should always be used with TLS. Its why you can't generally install multiple certs on the same ip without sni support, no http headers, uri, url's etc. make it over the wire before the transport layer handshake. I've never seen these credentials appear in logs, and many browsers strip the auth preamble from the address bar. Anyway just food for thought, http basic isn't as bad as made out.
- voxic11 13y agoUrls are encrypted over TLS