Apache basic authentication

Question

I apologize before hand if this is an obvious question: can Apache 2.0 + SSL + basic authentication be trusted in order to secure a website? The way I see it, SSL creates a secure connection between the client and the server and thus any HTTP requests containing the clear-text password should not be a security issue.

thanks, S.

Answer 1

You are correct, basic auth is secure as long as you can guarantee the connection is end-to-end encrypted. This means that you must configure the server to force SSL usage by redirecting HTTP requests to HTTPS, or not accept unencrypted connections at all for that URL.

Answer 2

"The only fully secure computer is one that is unplugged and turned off"

That said, Jim's answer is Good Enough if you accept SSL level of security :)