'Is basic authentication more secure than plain text passwords and usernames over HTTPS?
I am looking into basic authentication for an API project I'm working on. I had assumed basic authentication obfuscated the username and password into a hash which could not be reversed back into its original string. Looking into it, though, I found out that it is essentially base64 version of username:password passed as a token.
There isn't much online about this that can answer my specific question.
Essentially, how is basic authentication any more secure than simply passing usernames and passwords over HTTPS? All implementations I've seen so far use base64, which is easily decoded - so seems like it's not any more secure than a header for username and a header for password?
I ask because if it's not more secure, I am not sure why I would introduce another step into my process of having to base64 encode anything being sent in a POST request via HTTPS. I think I could see how this is more "secure" if the username:password is stored as a hash that could only be compared server side using the same hash algorithm, but since it's simply a base64 version of username:password, is it really introducing any other security benefits?
Sorry if this is a stupid question. I guess I know I can send something as a hash and compare it on the server side using the same hash, but I don't get why basic authentication is being referred to by some sources as "better" than simply putting two headers with plain text usernames and passwords.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
