Implementation of BASIC Authentication

Introduction

Basic authentication sends username and password in plain text or base64 encoded. Generally, using basic authentication is not a good solution.

There are a few issues with Basic Auth:

• The password is sent over the wire in base64 encoding (which can be easily converted to plaintext).

• The password is sent repeatedly, for each request. (Larger attack window)

• The password is cached by the web browser, at a minimum for the length of the window / process. (Can be silently reused by any other request to the server, e.g. CSRF).

• The password may be stored permanently in the browser, if the user requests. (Same as previous point, in addition might be stolen by another user on a shared machine).

How to Test

Steps:

• Go to Inspect Element in the browser

• In the network tab, you can see the request header of your application.

• Check in request headers whether Authorization Header uses BASIC authentication method as shown in the below screenshot.

How to Fix

The below list of authentication methods can be used for authorization.

• OAuth1.0 (Digest Scheme)

• OAuth2 (Bearer Token Scheme)

• OpenID Connect Discovery (JWT)

References:

https://blog.restcase.com/4-most-used-rest-api-authentication-methods/