sthope/gitea_templates
Template
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Basic auth on HTTPS is OK. (#79)

Browse Source
This commit is contained in:
Mohamed Oun 2017-07-29 00:18:07 +03:00 committed by Vahid Panjganj
parent 7880278c38
commit 479621190e
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@ -660,7 +660,7 @@ The **client app did something wrong** or The **API did something wrong**.
### 9.2 API security
These are some basic security best practices:
* Don't use basic authentication. Authentication tokens must not be transmitted in the URL: `GET /users/123?token=asdf....`
* Don't use basic authentication unless over a secure connection (HTTPS). Authentication tokens must not be transmitted in the URL: `GET /users/123?token=asdf....`
_Why:_
> Because Token, or user ID and password are passed over the network as clear text (it is base64 encoded, but base64 is a reversible encoding), the basic authentication scheme is not secure. [read more...](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication)