Is this a secure way to authenticate users?

user_12222306 0
Viewed 29

I am running a small local HTTP server that allows me to manage config files via GET requests. However, this action should require a password, so I came up with the following solution:

Let's say the password is test123. I hashed the password using SHA-512 and saved it to a .txt-file on my web server. When I want to get the config file main.json, I would send this request:

http://192.168.178.72/config.php?mode=get&file=main&password=test123

Is this a secure way of doing it?

web authorization authentication security http
2 Answers

No, because as you can see, the credentials are being displayed on the url, use POST instead.

user_133571160

No, you should use https instead and a POST request to avoid printing the passphrase in the url.

As long as you use http, every connection or connection attempt could suffer under a man-in-the-middle attack. Use of https and proper certificate pinning could avoid this

user_137422650
Related