HTTPS and BASIC authentication

Question

When I use HTTP BASIC authentication along with HTTPS, are the username and password securely passed to the server?

I would be happy if you can help me with some references.

I mean, it would be great if I can cite StackOverflow Q&A as a reference in, say, assignments, reports, exams, or even in a technical paper. But I think I am not there yet.

Answer 1

yes. if you're using https the conversation with the web server is entirely encrypted.

Answer 2

HTTP Basic Authorization and HTTPS both are different concepts.

• In HTTP Basic Authorization username and password are sent in clear text (In HTTP Digest Authorization password is sent in base64 encoded using MD5 algorithm)
• Whereas HTTPS is completely different functionality, here complete message is encrypted based on keys and SSL certificate.

Please Note: There is difference between authorization and security. HTTP Basic authorization is an authorization concept it is not security

YES. In your case the HTTP message with username and password will be encrypted and then sent to the server.

Answer 3

Yes, they are passed securely... if a hacker can decrypt your https transaction he can for sure decrypt the base64 user:password...

I know the more rocks you put the harder it takes... but base64 is not for security reasons

Answer 4

My other question has very good answers that also answer this question: