apacheauthenticationmod-auth

Apache basic authentication

I apologize before hand if this is an obvious question: can Apache 2.0 + SSL + basic authentication be trusted in order to secure a website? The way I see it, SSL creates a secure connection between the client and the server and thus any HTTP requests containing the clear-text password should not be a security issue.

thanks, S.

Solution

  • You are correct, basic auth is secure as long as you can guarantee the connection is end-to-end encrypted. This means that you must configure the server to force SSL usage by redirecting HTTP requests to HTTPS, or not accept unencrypted connections at all for that URL.