On 9/14/2011 4:22 PM, Ben Summers wrote:
HTTP basic authentication is widely supported in HTTP client
libraries, and much less hassle to use than passing tokens around.
The three major downsides with HTTP Basic Auth are:
1) No pretty login page
2) No reliable way to logout in most browsers
3) Requires sending the username and password over the wire
1 and 2 are irrelevant for a JSON API, and fossil's web ui already sends
the username and password in the clear over the wire unless you're using
HTTPS, so this is no greater risk, and it inherits the protection that
an HTTPS setup provides.
I vote for HTTP Basic Auth, provided that someone can confirm the major
browser AJAX functions support it.
(Curl and other libs certainly support it.)
--
Joshua Paine
LetterBlock: Web Applications Built With Joy
http://letterblock.com/
301-576-1920
_______________________________________________
fossil-users mailing list
[email protected]
http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
