Authentication (General questions)

Hello,
I'm experimenting with different solutions for user authentication with the WebServer ActiveX component. In my case I wish to protect the user data (username/password).

According to the documentation it seams like digest authentication is not supported. I know that HTTPS/SSL is supported but then the whole site will be encrypted, including all graphics. I believe this will reduce performance.

It would be nice to use the standard HTTP protocol but still have possibility to encrypt the sensitive information such as username and password.

Any comments or sugestions are appreciated.

Regards,
Michael from Sweden

Hi Michael,

I assume you are reffering to Basic authentication, using Username/Password, whoose has value is used for autnentication.

If so, why don't you try simply setting Authentication property to True, and AuthenticationType to authBasic?

Regards,
Damba

Thanks for reply,

'Basic access authentication' is considered today by many as insecure since the password and username is transferred without encryption. In 'Digest access authentication' this information is encrypted and considered as more secure.

I don't know if this is a serious issue in real life, but many forums recommend to stay away from Basic access authentication for security reasons. Instead, Digest access authentication or HTTPS/SSL is recommended.

Regards,
Michael

Hi Michael,

Sorry for misunderstanding your first post. I'll talk to our programmers, to see if we could implement DIGEST as authentication type.

We will inform you as soon as we have news on this.

Regards,
Damba

Micke,

I see that NTLM is supported - did you try using that one? It is not insecure as Basic is.

Let me know if it works for you!

Regards,
Kreso

Hi again,

I don't like the NT approach. I think I go for the SSL solution.
I think posting data from an unsecure page to a SSL page actually encrypt the data. This will do the protection I need. For all other trafic I can use normal http.

Thanks,
Michael