How Secure are Apache Passwords

[Nutthick]

I'm thinking about using Apache to handle some sensitive data, and protect it by using the Apache Username and Password system. How secure is the setup? Can is be easily hacked? Does anyone know anything about it?

Thanks

 

[sleipnir214]

I recommend that you not use Basic authentication but rather Digest authentication as the latter is more secure. See

http://httpd.apache.org/docs-2.0/mod/mod_auth_digest.html

for more information.

Keep in mind, too, that since HTTP is stateless, the browser has to keep track of a lot of information. If the user has logged in to your site, the browser will remember the user's credentials until the browser is shut down. Also, many modern browsers will offer to permenantly remember passwords for the user.

You might also think about using HTTPS.




Want the best answers? Ask the best questions!

TANSTAAFL!!