Basic Auth over http

Basic Auth sends the password with every request, so the connection has to be encrypted.

What it is

The site asks for a username and password through the browser prompt, and the address it asks on starts with http://.

Why it matters

A plain http connection shows the password to everyone on the network between the visitor and the site. Anyone who reads it can sign in as that user. Tenty rates the finding medium.

How Tenty checks it

Tenty asks the plain http address of your host. A 401 answer with a WWW-Authenticate: Basic header gives the finding.

How to fix it

Serve the protected area over https only, and redirect every http address to https before the prompt appears. Change the password that was sent over http.

How to reproduce

curl -sSI 'http://YOUR-APP/'

A WWW-Authenticate: Basic header on a 401 answer means the prompt appears on plain http.