Basic Authentication
Offers No Security
The authentication system used in the above example (
Basic
) has minimal security
as the password is sent in clear text (it is only encoded as
base64
, which is a simple
encoding rather than an encryption method). It should also be noted that the docu-
ments protected by this mechanism also go over the network in the clear. If security
is important, the entire HTTP session should be encrypted with Transport Layer Se-
curity (TLS).
The
/etc/apache2/authfiles/htpasswd-private
file contains a list of users and passwords; it
is commonly manipulated with the
htpasswd
command. For example, the following command is
used to add a user or change their password:
#
htpasswd /etc/apache2/authfiles/htpasswd-private user
New password:
Re-type new password:
Adding password for user
user
