22

When I use HTTP BASIC authentication along with HTTPS, are the username and password securely passed to the server?

I would be happy if you can help me with some references.

I mean, it would be great if I can cite StackOverflow Q&A as a reference in, say, assignments, reports, exams, or even in a technical paper. But I think I am not there yet.

1

4 Answers 4

27

yes. if you're using https the conversation with the web server is entirely encrypted.

3
  • 6
    +1. Even the fact that Basic Auth is taking place cannot be established from the outside.
    – Thilo
    Aug 12, 2010 at 4:33
  • @Thilo: Thank you; Can you help me with some references? Aug 12, 2010 at 17:50
  • 3
    Stripe does it like this (and they process credit card transactions). Jun 14, 2013 at 15:25
4

HTTP Basic Authentication and HTTPS both are different concepts.

  • In HTTP Basic Authentication username and password are sent in clear text (In HTTP Digest Authorization password is sent in base64 encoded using MD5 algorithm)
  • Whereas HTTPS is completely different functionality, here complete message is encrypted based on keys and SSL certificate.

Please Note: There is difference between authorization and security. HTTP Basic authorization is an authorization concept it is not security

YES. In your case the HTTP message with username and password will be encrypted and then sent to the server.

4
  • 4
    It's HTTP Basic authentication, not authorization, which is yet another concept.
    – Bruno
    Aug 12, 2010 at 13:21
  • By authorization I mean "401 Unauthorized" header as per RFC 2617. Sorry for creating confusion
    – Alam
    Aug 12, 2010 at 17:32
  • 1
    It is also worth to mention, that HTTPS also provides ways for authentication (certificate based log-in), not only encryption – HTTP Basic authentication may be not needed there. Aug 25, 2010 at 8:34
  • Also, Authentication & Authorization are two different concepts. Aug 20, 2011 at 1:51
3

Yes, they are passed securely... if a hacker can decrypt your https transaction he can for sure decrypt the base64 user:password...

I know the more rocks you put the harder it takes... but base64 is not for security reasons

2
  • Could you please state how you jumped from HTTP BASIC authentication to base64? Aug 25, 2010 at 8:44
  • 5
    Basic Authentication passwords are base64 encoded. These strings are later encrypted by SSL.
    – bnieland
    Jun 7, 2011 at 11:57
0

If a tool like Fiddler is installed on your local system, it could be used to forward your https transmissions decrypted to a third party. If someone sets it up to do this, they already own your system (either have physical access or full/root access).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.