It's unfortunate that people are down-voting instead of responding to you. I'm far from an expert but it would be interesting to see what other people think here...
Basic auth is insecure (i.e. sending credentials in plaintext) and poorly supported by browsers. For example how would you handle these scenarios:
- Force users to reauthenticate after a certain period of time.
- Allow user to logout without closing their browser.
I think Basic auth is more reasonable for server-server communications, combined with HTTPS and client-certs.
The best setup IMO is to have an HTTPS login page (form auth, hopefully with MFA) and use a session cookie. You can do server-side settings with this setup, you minimize the time when credentials are being sent (basically just once on login), and you can force your users to occasionally reauthenticate (either session timeout or manual logout) just in case they forgot to logout of a public computer.
For testing you could allow basic auth (make it configurable, or use user-agent sniffing to force browsers to use form auth).
Edit: formatting
Basic auth is insecure (i.e. sending credentials in plaintext) and poorly supported by browsers. For example how would you handle these scenarios:
I think Basic auth is more reasonable for server-server communications, combined with HTTPS and client-certs.The best setup IMO is to have an HTTPS login page (form auth, hopefully with MFA) and use a session cookie. You can do server-side settings with this setup, you minimize the time when credentials are being sent (basically just once on login), and you can force your users to occasionally reauthenticate (either session timeout or manual logout) just in case they forgot to logout of a public computer.
For testing you could allow basic auth (make it configurable, or use user-agent sniffing to force browsers to use form auth).
Edit: formatting