0
$\begingroup$

I have client connecting a server over HTTPS to send and retrieve data.

  • The client always connects through HTTPS
  • The certificate is known to the client beforehand (hard coded into the software)
  • The password is auto-generated, so not chosen by the client

For authentication, is there any reason I should do anything more complicated than sending username + password in plaintext over the HTTPS connection for every request?

The data is encrypted by the HTTPS layer, so I am not vulnerable, right?

$\endgroup$
  • $\begingroup$ this may be something for infosec SE. You're using TLS within an App (=not a browser page)? So there shouldn't be a MitM an you should be save against everything but social engineering and that's a large threat... $\endgroup$ – SEJPM May 20 '15 at 20:24
  • 1
    $\begingroup$ You should simplify it; there is no need to send username + password for every request. You should only have to send it once per session, although sending it for every request could allow for a stateless server design (bar the TLS connection handling, of course). $\endgroup$ – Maarten Bodewes May 21 '15 at 11:18
1
$\begingroup$

Given your ideal setup, I don't think you need anything else than plaintext authentication.

The only thing could be if the server at the end of the TLS link is not the one managing the authentication (in which case you do not necessarily want to reveal to it your password).

|improve this answer|||||
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.