2

It's a website backend. Since it will only be accessed by two persons, is there any disadvantage on using basic http auth? The website is under https.

edit: as the title points, there's confidential data inside.

izuna
  • 23
  • 2
  • 1
    Here's a good thread on the topic : http://security.stackexchange.com/questions/988/is-basic-auth-secure-if-done-over-https?rq=1 – Gudradain Feb 01 '17 at 21:57

1 Answers1

2

Basic auth has a few issues that were fixed in digest auth, but they mostly don't apply since you're using TLS (which should handle replay attacks and encryption of the secret values). It still might be a good idea to use digest auth anyways, because it's not worse.

Both of these authentication methods are still fairly primitive. The most notable weakness is that they don't include any sort of brute-force protection: an attacker can try potential credentials as fast as your web server will process them. This puts the onus on you to implement throttling in another system, like fail2ban. Similarly, there are no direct audit logs, so you need to make sure that your web server is configured to log authentication accesses, and create a system that can filter and search these logs in case you need to check later to see.

Other than that, there are standard UX/security concerns that may not matter much in your case, since you only have two users. One of these would be whether you have a shared password for everyone, or different user accounts; if it's the former, you have to (securely) distribute a new password any time you want to revoke someone's access, whereas with the latter you have to design a system that automatically updates the digest file and reloads your web server (or do this manually).

Xiong Chiamiov
  • 9,402
  • 2
  • 35
  • 78
  • I would argue against using digest auth. Digest auth was meant to provide some security when using plain http. When using https, the bonus of digest auth are lost and you add disadvantages like : it's more complicated and you can't use good password hashing to protect your password on the server. – Gudradain Feb 01 '17 at 22:06