How to send password to REST service securely?

Question

I am using Flask-Restful to build a REST service. The iOS device will then connect to this REST backend to sync the local data.

The service will be accessed over a https connection.

The REST service is stateless and the user has to authenticate upon each request. Hence the username and password will be sent in clear format to the REST service. The backend will hash the password and check against the existing hashed password in the database.

api.add_resource(Records, '/rest/records/<string:email>/<string:password>/<string:ios_sync_timestamp>')

Now one problem I see with this approach is that the username and password are in clear format as part of the GET url. The server log will obviously track this. Now if my backend was ever hacked into, the log files would compromise all the usernames and passwords.

What is the best solution to this? I was thinking maybe sending username and password as POST arguments, but how do I that with GET requests then?

class Records(Resource):
    def get(self, email, password, ios_sync_timestamp):
        pass
    def post(self, email, password, ios_sync_timestamp):
        pass

Answer 1

To authenticate each requests with a username and password like you want, you should use: Basic Authentication.

To use it, it's pretty simple and it works with all HTTP methods (GET, POST, ...). You just need to add an HTTP header into the request:

Authorization: Basic <...>

The <...> part is the username:password encoded in base64.

For example, if your login is foo and your password is bar. The HTTP header should have this line:

`Authorization: Basic Zm9vOmJhcg==`

Through your HTTPS connection, it's secure.

EDIT: Using Flask, you can use Flask HTTP auth to achieve this "automatically".