Search code examples
httpsbasic-authentication

HTTP Basic Authentication credentials passed in URL and encryption

I have a question about HTTPS and HTTP Authentication credentials.

Suppose I secure a URL with HTTP Authentication:

<Directory /var/www/webcallback>
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /var/www/passwd/passwords
Require user gooduser
</Directory>

I then access that URL from a remote system via HTTPS, passing the credentials in the URL:

https://gooduser:[email protected]/webcallback?foo=bar

Will the username and password be automatically SSL encrypted? Is the same true for GETs and POSTs? I'm having a hard time locating a credible source with this information.

Solution

  • Will the username and password be automatically SSL encrypted? Is the same true for GETs and POSTs

    Yes, yes yes.

    The entire communication (save for the DNS lookup if the IP for the hostname isn't already cached) is encrypted when SSL is in use.