Comment on Simple Ways to Protect an APIparentComments−EvanAnderson12yThe main criticism relates to eavesdropping. Wrapping Basic or Digest authentication in TLS eliminates that issue.−xorbyte12yThe article makes no mention of TLS anywhere, and the example endpoints are all HTTP. So, this is a thoroughly insecure implementation, relying on very weak security mechanisms, prone to straightforward interception and tampering, replay etc.
Comments
The main criticism relates to eavesdropping. Wrapping Basic or Digest authentication in TLS eliminates that issue.
The article makes no mention of TLS anywhere, and the example endpoints are all HTTP. So, this is a thoroughly insecure implementation, relying on very weak security mechanisms, prone to straightforward interception and tampering, replay etc.