How does a "session" exist without "credentials" that have to be verified every time? Http is stateless so even non-native authentication solutions have to deal with these problems. Why can't your server generate a "session token" and require it to be passed using basic auth? Wouldn't you want to hash these "session tokens" on your server in case it becomes compromised?
Re:Living without the modern browser
by justinsaccount on Friday July 12, 2019 @04:55PM
(#20424408)
non-native authentication solutions do deal with these problems. HTTP Basic auth does not. full stop.
old, yes. good, no.
* Browsers never implemented a way to "log out", so creds end up cached in memory until the browser is restarted.
* There is no concept of a session so the credentials need to be included in each request and verified every time. If you use something like bcrypt or pbkdf2 on the backend that means every request will take hundreds of milliseconds.
* Since every request needs to be verified you can't easily use 2FA, without ugly hacks that 'remember' that the earlier creds were valid.
Hopefully things like WebAuthn will result in a resurgence of browser native autentication.