Is basic access authentication secure?

Nathan Osman picture Nathan Osman · Jul 24, 2010 · Viewed 34.7k times · Source

Using Apache, it is quite simple to set up a page that uses basic access authentication to prompt a user for a name/password and use those credentials in some way to grant access to that user.

Is this secure, assuming the connection between the client and server is secure?

Answer

Chris Diver picture Chris Diver · Jul 24, 2010

The worry about basic auth is that the credentials are sent as cleartext and are vulnerable to packet sniffing, if that connection is secured using TLS/SSL then it is as secure as other methods that use encryption.