44

I am building a web application and my web server is secure, meaning that it uses an ssl cert with the front end to encrypt the connection.

When a user logs in, a JSON object which looks like this is created, and sent to the server.

{
    username:"the user's username",
    password:"the user's password"
}

On the server this is verified with a hashing algorithm that uses a salt. Once it is verified an api token is created which is valid for a certain amount of time, and is passed back and forth in the header in order to verify the user when requests are being made. Is sending the username and password like this best practice/secure, or is it better to send it in the header?

4
  • Well it actually depends, but in any situation if someone else than user can access his request, then there are other things they need to carry about first.
    – Kadaj
    Commented Jul 27, 2017 at 8:24
  • Meaning that it uses SSL? and the POST is sent via HTTPS? The certificate doesn't do any encrypting.
    – user207421
    Commented Jul 27, 2017 at 8:40
  • And why aren't you using Container Managed Authentication?
    – user207421
    Commented Jul 27, 2017 at 9:03
  • 2
    @EJP because I don't know what this is and what the benefits are, could you provide a link that explains what Container Managed Authentication is? Plus points, if you provide an easy to follow tutorial too. Commented Jul 27, 2017 at 14:52

2 Answers 2

42

Lets divide it to many points:

1) you use a valid SSL certificate to secure the communication between the user and the server (It must be valid)

2) Sending the username and password in the body of the POST request is the best practice (Never use GET to send sensitive information such as Credentials)

3) Sending the api token in the HTTP request and response headers is the best practice (Again never use GET to send sensitive information such as session tokens)

So based on the points above, it seems that there is no risk in this implementation but you need to take the following points in your consideration:

1) The time out of the API token should be short in case of idle user. (5 ~ 15 mins are the averages based on the criticality of the application)

2) The length of the API token should be long string approx. 30 ~ 40 characters.

3) The API token generation must be randomized and hard to predict to protect from (session prediction attacks.)

Hope this help you.

10
  • 3
    "No risk"? There are always risks.
    – quinz
    Commented Jul 27, 2017 at 11:04
  • 2
    Sure there is no such thing called "No risk" but I mean that the proposed solution follows the best practices. In addition to that I listed some security concerns in the answer that he should take them in his consideration while implementing this solution.
    – kingasmk
    Commented Jul 27, 2017 at 11:11
  • 1
    I'm not so knowledgeable on this, but just imagining, could something like a browser extension read this data, like post/form data created to be sent with a http(s) (or any other protocol) request?
    – 0xc0de
    Commented Dec 24, 2018 at 8:29
  • 1
    basically, it's not possible because of modern browsers security such as Content Security Policy which prevents any web domain to read data from other domains.
    – kingasmk
    Commented Jan 11, 2019 at 12:59
  • 1
    In terms of best practice, I don't think sending username and password in a POST request body is secure as I mentioned above, you should be using the basic authentication scheme. It won't explicitly show the bodies revealing the credentials but will at least mask them using base64.
    – 6rchid
    Commented Mar 5, 2021 at 0:52
15

What you are describing is basically HTTP basic authentication.

Is sending the username and password like this best practice/secure, or is it better to send it in the header?

In security point of view I cannot think of a big difference whether you send the credentials in the body or in the header. Basically whoever manages to read the clear text message, can see the credentials in both components. The common practice when using the basic authentication is to use the HTTP header though:

Authorization: Basic VGVzdFVzZXI6UGFzc3dvcmQxMjM0

where VGVzdFVzZXI6UGFzc3dvcmQxMjM0 is your base64-encoded credentials. The decoded string in this case is: TestUser:Password1234

It is important to realize that in your case the TLS is the only protection for the credentials in transit so you must identify all the nodes in the communication channel that could potentially expose the clear message. For example if you are using proxies that would terminate the TLS, those proxies are potential vectors for MITM attacks.

If you want to increase the security for the credentials in transit, one option could be to implement asymmetric end-to-end encryption so that you would encrypt the credentials with an authenticated public key on the client-side (e.g. certificate signed by a trusted CA) and then decrypt it at the destination with the private key known only for your server. In this case you would not need to worry too much what happens to the message in-transit.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.