Living without the modern browser

Re:Living without the modern browser by cp9 on Wednesday July 10, 2019 @11:20AM (#20402813)

are people really suggesting basic auth again, is it 1993 outside? Basic auth is horrendous security practice, you're passing a header that has your user and password in plaintext, it's insane to suggest that in 2019

[ Parent | on HN ]

Re:Living without the modern browser by thekyle on Wednesday July 10, 2019 @11:38AM (#20402988)

What makes submitting a plaintext password in an Auth header worse than submitting a plaintext password in a POST body?

[ Parent | on HN ]

Re:Living without the modern browser by cp9 on Wednesday July 10, 2019 @11:54AM (#20403156)

there's no way to log out, the browser has to store it instead of a session cookie which can be invalidated if it's stolen.

plus what's in this comment https://security.stackexchange.com/questions/988/is-basic-au...

[ Parent | on HN ]

Re:Living without the modern browser by thekyle on Wednesday July 10, 2019 @12:00PM (#20403214)

Thanks, I didn't realize that the password was re-sent for every request to the site.

[ Parent | on HN ]