We enter our usernames and password on pretty much all the sites we commonly visit. Authentication is probably one of the first things you're being taught when starting to work with PHP. For some reason, in 99% of the cases this is done through an HTML form, with the username and password submitted as a urlencoded string.
You probably know that HTTP also has native authentication, in the form of Basic and Digest authentication (read my older article if you want to know how). Every browser and pretty much any HTTP client does too. There's some big benefits to that, because it provides a very standardized mechanism to authenticate a client, whether you're a machine or human.
What baffles me is that HTTP authentication
hasn't been developed further. HTTP Digest is pretty secure by itself,
and has some nice features (hashed password, protection against man in
the middle and replay attacks, message digests) which is way more
advanced than an HTML POST form with a session cookie can provide.
- There's no way for a user to see if they are authenticated to a site. Perhaps a username in the addressbar?
- Pretty much everybody always wonders how they can code a logout mechanism. Because there are no session cookies that can be destroyed, there are some hacks that trick the browser to ask for credentials again. There should be no need for the server to provide this functionality. The browser knows it's logged in, and HTTP applications are stateless. We need an in-browser log-out button.
So, does anyone know how this happened? Is there a major flaw in HTTP authentication I'm just missing?