I have client connecting a server over HTTPS to send and retrieve data.
- The client always connects through HTTPS
- The certificate is known to the client beforehand (hard coded into the software)
- The password is auto-generated, so not chosen by the client
For authentication, is there any reason I should do anything more complicated than sending username + password in plaintext over the HTTPS connection for every request?
The data is encrypted by the HTTPS layer, so I am not vulnerable, right?