Search code examples
httpbasic-authentication

Is basic access authentication secure?


Using Apache, it is quite simple to set up a page that uses basic access authentication to prompt a user for a name/password and use those credentials in some way to grant access to that user.

Is this secure, assuming the connection between the client and server is secure?


Solution

  • The worry about basic auth is that the credentials are sent as cleartext and are vulnerable to packet sniffing, if that connection is secured using TLS/SSL then it is as secure as other methods that use encryption.