Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>If you are using password authentication you need to store the password in the server so you can validate the password you send from the client is Ok.</p> <p>In your particular case you will be using basic authentication, as you want the simplest. Basic authentication over HTTP/HTTPS encodes the password with base64 but that's not a protection measure. Base64 is a two way encoding, you can encode and decode a chunk of data and you need no secret to do it. The purpose of Base64 encoding is codify any kind of data, even binary data, as a string.</p> <p>When you enter the password and send it over HTTPS, the HTTPS tunel avoids anyone from seeing your password.</p> <p>Other problem comes if someone gets access to your server and reads the password "copy" that you are using to check if the entered password was valid. The best way to protect is hashing it. A hash is a one way codification system. This means anyone can hash a password, but you can not unhash a chunk of data to discover the password. The only way to break a hashed password is by brute force. I'll recommend using MD5 or SHA hashes. </p> <p>So to make it simple. The client uses http/https basic authentication, so you'll encode your password in base64. Pass it through a header, not the URL. The server will contain a hased copy of the password either on databse or wherever you want. The backend code will recibe the http request, get the passowrd, base64 decode it and then hash it. Once hashed, you will check if its equal to the copy stored in the server.</p> <p>This is it. Hope it helps!</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload