I have a site (running a 3rd party app) that’s available over HTTPS and HTTP. It allows people to log in with Basic Authentication. I’m trying to force all logins to happen over HTTPS rather than HTTP.
The app is odd in that the authentication “realm” is the root of the domain (/), and 401s are returned based on query string parameters rather than the URL path. I think I’ve got my RewriteRules set up properly so that any request that could result in a 401 is redirected to HTTPS first. However, I’m worried that after logging into the secure site, if users navigate back to the HTTP version somehow, browsers will still send Authorization headers (now unencrypted) without seeing a 401 since it’s all the same domain with the /same/path/structure. That is, I’m worried about this behaviour from RFC 2617:
A client MAY preemptively send the corresponding Authorization header with requests for resources in that space without receipt of another challenge from the server.
Should I worry? Or does switching protocols (https to http) prevent browsers from sending those preemptive auth headers?
We heavily use basic auth for our application. All using https of course 🙂
Browsers have a good sandbox model, they know that when the protocol changes, the target machine may not be the same anymore. You don’t have to worry about browsers submitting the authentication information.
Even when they run into the initial 401, they will still ask the user for the username/password pair.