Insecure authentication over HTTP (Basic Authentication)

Description

The target application was found to authenticate users using the Basic Authentication scheme over HTTP. Basic Authentication base64 encodes the username and password and sends it in the Authentication header. Attackers who are in between the communication path (or on the same local network) of the client and server could use packet sniffers to read and decode the username and password.

Remediation

If possible, switch to a more robust method to authenticate users such as OAuth 2.0, or storing usernames and passwords in a data store protected by the Argon2id algorithm. If Basic Authentication must be used, ensure credentials are only transmitted over secure channels such as HTTPS/TLS.

Details

ID	Aggregated	CWE	Type	Risk
287.1	false	287	Passive	Medium

Links

• OWASP
• OAuth 2.0
• CWE-287
• RFC