Login user via GET (basic auth header) or POST

user_3549629 0
Viewed 1418

I've been doing some HTTP methods and header research recently if we should use GET with basic authorization instead of POST when submitting?

HTTP Methods

The GET method requests a representation of the specified resource. Requests using GET should only retrieve data.

The POST method submits an entity to the specified resource, often causing a change in state or side effects on the server.

As we see here, the POST method normally changes the state of the server. If sending out JWTs/HTTP cookies, we are not modifying the state of the server. Nor are we creating a new resource in the server.

I understand that we should not not send the username and password as a GET parameter but should we use the authorization header instead?

Basic authentication For "Basic" authentication the credentials are constructed by first combining the username and the password with a colon (aladdin:opensesame), and then by encoding the resulting string in base64 (YWxhZGRpbjpvcGVuc2VzYW1l). Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l

The only advantage I see to using POST over GET is that we need no extra code in the HTML/JS on the client side to send headers via the fetch API. To send headers, we would need an onsubmit and then check if status code is 200. If 200, we will need to redirect to the page after the login screen. Then again, if using the fetch API, this means the server does not need to send a new HTML page to the client all the time either.

Should we use GET with basic auth or POST when logging in since we don't create a resource/modify the server state? Would this change if say we enable 2FA since we would need to generate a code for that user?

http-method basic-authentication http-headers authentication
1 Answers

Doing basic authentication in the browser and using GET is not that recommended.

To do your own login form it is better to always do it using HTTPS and POST. Do post the username/password in the body of the request and secure it with proper CSRF protection.

If you want to level up, you can always look at the OpenIDConnect approach, but that is more advanced depending on your needs.

Also, a good approach is to explore how existing site implement a login form and look at the HTTP(s) traffic in a tool like Fiddler.

Andy_684900
Related