The History of the URL: Path, Fragment, Query, and Auth

Re:The History of the URL: Path, Fragment, Query, and Auth by microDude on Monday July 18, 2016 @05:36PM (#12118190)

I am not a web developer, but I have to ask.

Using basic authentication over SSL, does that mean if you entered https://user:pass@domain that the user and pass would be sent in the clear, or does this get put into the header and encrypted?

[ Parent | on HN ]

Re:The History of the URL: Path, Fragment, Query, and Auth by dincer on Monday July 18, 2016 @05:39PM (#12118205)

Yes, basic authentication is encrypted over SSL but there are more problems to that: https://security.stackexchange.com/questions/988/is-basic-au...

[ Parent | on HN ]

Re:The History of the URL: Path, Fragment, Query, and Auth by csbowe on Monday July 18, 2016 @05:40PM (#12118208)

It's base64 encoded and put into the header, according to the article.

[ Parent | on HN ]

Re:The History of the URL: Path, Fragment, Query, and Auth by colejohnson66 on Monday July 18, 2016 @06:39PM (#12118433)

But if you use HTTPS, those headers are encrypted, right?

[ Parent | on HN ]

Re:The History of the URL: Path, Fragment, Query, and Auth by kevin_thibedeau on Monday July 18, 2016 @06:46PM (#12118463)

The problem is they can end up in the logs of the receiving server and if that gets hacked...

[ Parent | on HN ]