• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 303
  • Last Modified:

https and htaccess authentication

I've read that using the basic http authentication is insecure (it sends passwords cleartext, right?).  However, if someone is browsing my site via an SSL connection, would that password still be sent cleartext, or would it be encrypted as part of the SSL connection?

Also, if I redirect the user from a non-ssl part of the site to an SSL part of the site and at the same time authenticate the user via htaccess authentication, would it establish the SSL connection before transmitting the password, or would that happen after it establishes htaccess login?

Using standard linux + apache.

Thanks.
0
jimstar
Asked:
jimstar
1 Solution
 
TintinCommented:
Any traffic going over a HTTP connection is in clear text.  Anything going over a HTTPS connection is encrypted (including passwords).

WIth the redirection, it depends where the htaccess authentication occurs.  If it occurs on the HTTPS redirect, then the password will be encrypted, otherwise it will be plain text.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now