Basic authentication is a vulnerable method of user authentication that should be avoided. It functions by transmitting a Base64 encoded username and password. As Base64 is easy to recognize and reverse, sensitive data may be leaked this way.
Basic authentication is a simple and widely used method of user authentication for HTTP requests. When a client sends a request to a server that requires authentication, the client includes the username and password (concatenated together and Base64 encoded) in the "Authorization" header of the HTTP request. The server verifies the credentials and grants access if they are valid. Every request sent to the server to a protected endpoint must include these credentials.
Basic authentication is considered insecure for several reasons:
These security limitations make basic authentication an insecure choice for authentication or authorization over HTTP.
Basic authentication transmits passwords in plain text, which makes it vulnerable to interception by attackers.
If an attacker gains access to the network traffic, they can easily capture the username and password. Basic authentication does not provide any mechanism to protect against session hijacking attacks. Once a user is authenticated, the session identifier (the username and password) is sent in clear text with each subsequent request. If attackers can intercept one request, they can use it to impersonate the authenticated user, gaining unauthorized access to their account and potentially performing malicious actions.
Basic authentication does not have any built-in protection against brute-force attacks. Attackers can repeatedly guess passwords until they find the correct one, especially if weak or commonly used passwords are used. This can lead to unauthorized access to user accounts and potential data breaches.
The following code uses basic authentication to send out an HTTP request to a protected endpoint.
String encoded = Base64.getEncoder().encodeToString("login:passwd".getBytes());
HttpURLConnection conn = (HttpURLConnection) url.openConnection();
conn.setRequestMethod("POST");
conn.setDoOutput(true);
conn.setRequestProperty("Authorization", "Basic " + encoded); // Noncompliant
// An access token should be retrieved before the HTTP request
String accessToken = System.getenv("ACCESS_TOKEN");
HttpURLConnection conn = (HttpURLConnection) url.openConnection();
conn.setRequestMethod("POST");
conn.setDoOutput(true);
conn.setRequestProperty("Authorization", "Bearer " + accessToken);
Token-based authentication is a safer alternative than basic authentication. A unique token is generated upon successful authentication and sent to the client, which is then included in subsequent requests. Therefore, it eliminates the need to transmit sensitive credentials with each request. OAuth also works by authenticating users via tokens. It gives even more flexibility on top of this by offering scopes, which limit an application’s access to a user’s account.
Additionally, both token-based authentication and OAuth support mechanisms for token expiration, revocation, and refresh. This gives more flexibility than basic authentication, as compromised tokens carry much less risk than a compromised password.
With basic authentication, user credentials are transmitted in plain text, which makes them vulnerable to interception and eavesdropping. However, when HTTPS is employed, the data is encrypted before transmission, making it significantly more difficult for attackers to intercept and decipher the credentials. If no other form of authentication is possible for this code, then every request must be sent over HTTPS to ensure credentials are kept safe.
The following code uses basic authentication to send out an HTTP request to a protected endpoint.
import org.apache.http.client.methods.HttpPost;
String encoded = Base64.getEncoder().encodeToString("login:passwd".getBytes());
HttpPost httpPost = new HttpPost("http://api.example.com/foo");
httpPost.setHeader("Authorization", "Basic " + encoded); // Noncompliant
import org.apache.http.client.methods.HttpPost;
// An access token should be retrieved before the HTTP request
String accessToken = System.getenv("ACCESS_TOKEN");
HttpPost httpPost = new HttpPost("http://api.example.com/foo");
httpPost.setHeader("Authorization", "Bearer " + accessToken);
Token-based authentication is a safer alternative than basic authentication. A unique token is generated upon successful authentication and sent to the client, which is then included in subsequent requests. Therefore, it eliminates the need to transmit sensitive credentials with each request. OAuth also works by authenticating users via tokens. It gives even more flexibility on top of this by offering scopes, which limit an application’s access to a user’s account.
Additionally, both token-based authentication and OAuth support mechanisms for token expiration, revocation, and refresh. This gives more flexibility than basic authentication, as compromised tokens carry much less risk than a compromised password.
With basic authentication, user credentials are transmitted in plain text, which makes them vulnerable to interception and eavesdropping. However, when HTTPS is employed, the data is encrypted before transmission, making it significantly more difficult for attackers to intercept and decipher the credentials. If no other form of authentication is possible for this code, then every request must be sent over HTTPS to ensure credentials are kept safe.