News for hackers. Stuff that matters.

A comment on How Open ID Connect Works. Parent comment

Re:How Open ID Connect Works by chucke on Thursday January 04, 2024 @04:27PM (#38872493)
And security (basic auth is as good as sending clear text passwords).
[ Parent | on HN ]
Re:How Open ID Connect Works by Nextgrid on Thursday January 04, 2024 @06:15PM (#38873629)
> sending clear text passwords

Which is totally fine to do over HTTPS.

[ Parent | on HN ]
Re:How Open ID Connect Works by ustolemyname on Friday January 05, 2024 @01:40AM (#38876428)
Passwords need to be sent both with the request, and to the requestor. I think GP is referring to sending credentials to the service making the request.

It is far better to give service XYZ a time-bound and scope limited token to perform a request than a user's username and password.

[ Parent | on HN ]