News for hackers. Stuff that matters.

A comment on Living without the modern browser. Parent comment

Re:Living without the modern browser by yoz-y on Wednesday July 10, 2019 @09:36AM (#20401794)
> Does even anybody remember the good old HTTP basic acess authentification? This is one of the most accessible ways of protecting ressources, it can be consumed by any HTTP client (!), and it is just reduced to the basic.

Basic authentication is fine if all you need is to control access to documents, but it can not be used for access delegation or any scope control.

[ Parent | on HN ]
Re:Living without the modern browser by kalleboo on Wednesday July 10, 2019 @10:32AM (#20402311)
> but it can not be used for access delegation or any scope control

Why not? It's just a header with a username and password. Your app can do whatever you want with that info. It also doesn't strictly have to be a username and password, you allow app tokens or whatever you want in there, that's just what the browser UI calls it.

[ Parent | on HN ]
Re:Living without the modern browser by duijf on Wednesday July 10, 2019 @09:42AM (#20401838)
That depends entirely on how/where you implement this.

You can make your application code check the authorization header, get the username from there and do authorization based on that.

[ Parent | on HN ]
Re:Living without the modern browser by SmellyGeekBoy on Wednesday July 10, 2019 @11:00AM (#20402567)
I assume you're not a .NET developer...
[ Parent | on HN ]
Re:Living without the modern browser by yoz-y on Wednesday July 10, 2019 @11:57AM (#20403188)
No I'm not. Care to elaborate?
[ Parent | on HN ]