I have client connecting a server over HTTPS to send and retrieve data.

  • The client always connects through HTTPS
  • The certificate is known to the client beforehand (hard coded into the software)
  • The password is auto-generated, so not chosen by the client

For authentication, is there any reason I should do anything more complicated than sending username + password in plaintext over the HTTPS connection for every request?

The data is encrypted by the HTTPS layer, so I am not vulnerable, right?

  • $\begingroup$ this may be something for infosec SE. You're using TLS within an App (=not a browser page)? So there shouldn't be a MitM an you should be save against everything but social engineering and that's a large threat... $\endgroup$
    – SEJPM
    May 20, 2015 at 20:24
  • 1
    $\begingroup$ You should simplify it; there is no need to send username + password for every request. You should only have to send it once per session, although sending it for every request could allow for a stateless server design (bar the TLS connection handling, of course). $\endgroup$
    – Maarten Bodewes
    May 21, 2015 at 11:18

1 Answer 1


Given your ideal setup, I don't think you need anything else than plaintext authentication.

The only thing could be if the server at the end of the TLS link is not the one managing the authentication (in which case you do not necessarily want to reveal to it your password).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.