Join Log in
Score:1
Vinayak avatar Server

HTTPD server does LDAP authentication. How does the mechanism work?

ca flag
Vinayak

I have a HTTPD apache server which does LDAP authentication. When the user hits the URL http://localhost/, a browser prompt pops up asking for username and password.

  • How are the username and password carried from browser to the HTTPD server ? Are they really transferred to server through network? If so, are they encrypted?
  • Is browser prompt safer than entering the credentials directly in the sign-in page of a website ?

Need a simple explanation on how the authentication is working.

43
0 + 0
Score:2
avatar Server
jp flag
AlexD

The 'Basic' HTTP Authentication Scheme is described in RFC 7617.

The credentials are passed as an HTTP header and not encrypted so Basic Auth use over plain HTTP without encryption is insecure. If used over HTTPS there are other issues - see this question

0 + 0
Score:0
avatar Server
cn flag
Bob

Two answer your second question:

Is browser prompt safer than entering the credentials directly in the sign-in page of a website ?

No.

The "browser prompt", Basic HTTP Authentication, has only one redeeming quality and the name says it all, it is the most basic, the most simple authentication scheme that you can use.

But that simplicity does not provide good security.

Many of those shortcomings are under the hood, AlexD already referred to most in this answer but something even your users may notice:

  • there is no "sign out" method
0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.