So now I’m at the point where I need to work on the authentication part for the stats server code, and I noticed that my plan to use http digest authentication doesn’t work as that requires to store the plaintext password of clients on the server which I’d like to avoid (generally one should only store a hash of the passwords in the authentication backend).
\nBefore going into alternatives let me list a few requirements I have for them:
\n– don’t require the real password in the auth backend
\n– don’t transmit the real password unsecured over the network
\n– must work with only http headers, don’t touch the body in any way
\n– must be easily scriptable
\n– preemptive authorization (e.g. send the auth data with the first request)
\n– should work within a webbrowser
\nSo, what options do I have now? Well, I can’t see a single alternative that fits all requirements (if you know one let me know), the closest is http basic auth, but I really don’t want to send the password over network as almost-plaintext. This lead me to the idea of extending it with gpg-encrypting the password, but that’s not transparent when you use the browser (not that important for the current use case) and more importantly gpg adds about 600 bytes of protocol overhead for encrypted data (without using –armor), with the base64 encoding required for http that’s almost one kilobyte just for a password that originally only had a few bytes.
\nSo, right now I have to select between a rather hackish, inefficient and untested but secure solution and a well-tested, relatively efficient and well-specified but insecure one. What would people prefer here?
\nOr does anyone know another solution to the problem that satisfies the above requirements? (the first four are hard requirements, the other two I could work around)<\/p>\n","protected":false},"excerpt":{"rendered":"
So now I’m at the point where I need to work on the authentication part for the stats server code, and I noticed that my plan to use http digest authentication doesn’t work as that requires to store the plaintext password of clients on the server which I’d like to avoid (generally one should only … Continue reading how to authenticate<\/span><\/a><\/p>\n","protected":false},"author":46,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[7,8],"tags":[],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/blogs.gentoo.org\/genone\/wp-json\/wp\/v2\/posts\/26"}],"collection":[{"href":"https:\/\/blogs.gentoo.org\/genone\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.gentoo.org\/genone\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.gentoo.org\/genone\/wp-json\/wp\/v2\/users\/46"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.gentoo.org\/genone\/wp-json\/wp\/v2\/comments?post=26"}],"version-history":[{"count":1,"href":"https:\/\/blogs.gentoo.org\/genone\/wp-json\/wp\/v2\/posts\/26\/revisions"}],"predecessor-version":[{"id":48,"href":"https:\/\/blogs.gentoo.org\/genone\/wp-json\/wp\/v2\/posts\/26\/revisions\/48"}],"wp:attachment":[{"href":"https:\/\/blogs.gentoo.org\/genone\/wp-json\/wp\/v2\/media?parent=26"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.gentoo.org\/genone\/wp-json\/wp\/v2\/categories?post=26"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.gentoo.org\/genone\/wp-json\/wp\/v2\/tags?post=26"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}