tags:

views:

90

answers:

2
+1  Q: 

Apache basic authentication

I apologize before hand if this is an obvious question: can Apache 2.0 + SSL + basic authentication be trusted in order to secure a website? The way I see it, SSL creates a secure connection between the client and the server and thus any HTTP requests containing the clear-text password should not be a security issue.

thanks, S.

+2  A: 

You are correct, basic auth is secure as long as you can guarantee the connection is end-to-end encrypted. This means that you must configure the server to force SSL usage by redirecting HTTP requests to HTTPS, or not accept unencrypted connections at all for that URL.

Jim Garrison  2009-10-27 14:21:15
Thanks Jim, turns out I unfortunately will have to use a session-based authentication since I have to be able to logout users as well.
S.D  2009-10-27 14:23:16
You should still force SSL. The same caveats apply to form-based auth since a password has to be transmitted.
Jim Garrison  2009-10-27 14:31:46
You can logout users with Basic Auth, kind of. It's not terribly pretty and Apache doesn't have any method built in to do it. What you would have to do is POST to a `/logout` script that returns 401 when the user passes *correct* auth. You then ask the user to submit wrong details to the auth dialogue (typically, empty username/password). Your script responds 200 or 303, at which point the browser dumps the correct auth in favour of the non-auth.
bobince  2009-10-27 15:11:34
A: 

"The only fully secure computer is one that is unplugged and turned off"

That said, Jim's answer is Good Enough if you accept SSL level of security :)

DVK  2009-10-27 14:27:31

related questions

How do I add a MIME type to .htaccess?
Difference between the Apache HTTP Server and Apache Tomcat?
How do I support SSL Client Certificate authentication?
Why can't I connect to my CAS server with Perl's AuthCAS?
Cleanest & Fastest server setup for Django
Installing Apache Web Server on 64 Bit Mac
Running Apache alongside another web server?
Algorithm behind MD5Crypt
Can you compile Apache HTTP Server and redeploy its binaries to a different location ?
mod_rewrite rule to redirect all requests except for one specific path
How do I create a self signed SSL certificate to use while testing a web app.
Software for Webserver Log Analysis?
What is the difference between an endpoint, a service, and a port when working with webservices?
What are the proper permissions for an upload folder with PHP/Apache?
mod_rewrite to alias one file suffix type to another
How do you redirect HTTPS to HTTP?
Using mod_rewrite to Mimic SSL Virtual Hosts?
User authentication on Resin webserver
How do you set up Python scripts to work in Apache 2.0?
Block user access to internals of a site using HTTP_REFERER
.htaccess directives to *not* redirect certain URLs
How can I get the authenticated user name under Apache using plain HTTP authentication and PHP?
Make XAMPP/Apache serve file outside of htdocs
Apache/PHP: error_log per Virtual Host?
How do I track file downloads with apache/PHP