Question

I have a server which supports NTLM and basic authentication schemes and I am using curl to connect to this server using https.

For certain reasons, I want curl to use basic authentication scheme when both NTLM and basic is supported, if not use NTLM, i.e. I want to patch curl, and reverse the order of the preference of the authentication scheme.

I have read the following comment in the curl source code:

The order of these checks is highly relevant, as this will be the
order of preference in case of the existence of multiple accepted
types.

Granted that basic authentication is too simple, but since I am using SSL, it shouldn’t affect security, should it?
Would there be any adverse effects of this reversal?

Answer 1

See this question for a detailed answer:

https://security.stackexchange.com/questions/988/is-basic-auth-secure-if-done-over-https