#basic auth

CISA Calls for Expedited Adoption of Modern Authentication Ahead of Deadline

Home › Identity & Access CISA Calls for Expedited Adoption of Modern Authentication Ahead of Deadline By Ionut Arghire on June 29, 2022 Tweet The US Cybersecurity and Infrastructure Security Agency (CISA) is urging federal agencies and private organizations to switch to Modern Auth in Exchange Online before October 1, 2022. A legacy authentication method, Basic Auth does not support multi-factor…

lets say id:password are aseem:password, when encoded it looks like YXNlZW06UGFzc3dvcmQ= Here is the sample request with basic auth curl –request POST ‘https://my.web.com/sso/v2.0/user/accounts’ \–header ‘Content-Type: application/json’ \–header ‘User-Agent: latest’ \–header ‘Authorization: Basic YXNlZW06UGFzc3dvcmQ=’ \–

SSRS/HTML/JavaScript – 頁面轉送Basic驗證效果

SQL Server Reporting Services 如果要實現匿名驗證來瀏覽的話，必須替換到整個報表伺服器的驗證機制(Custom驗證方式搭配Web.config參數設定，且無法與既有的NTLM、Basic等其他驗證並存)。

以下提供一個能達到近似匿名驗證效果的方式，不需要輸入帳號密碼依然能瀏覽SSRS的報表。

在同網域的 Web Server 上建立網頁 (基於安全考量跨頁存取必須在相同網域)

透過事先內置驗證資訊的 javascript 到目標報表進行驗證

再透過該網頁的 IFrame 瀏覽報表

Board body, html { margin: 0; padding: 0; height: 100%; overflow: hidden; } #content { position:absolute; left: 0; right: 0; bottom: 0; top:…

Base64 encode on shell

Sometimes you need to encode a string  with a base64 encoding. For example when trying to send a HTTP request with a Basic Authentication header like that:

### own controller: POST http://thedomain.com/webhook/post?XDEBUG_SESSION_START=11931 Content-Type: application/json Authorization: Basic c25zOlVzZVRoZWZvcmNlCg== { "uuid": "08e9a8d3-9279-4af5-88ff-ebe42359f0e0", "eventname":…

Randall Degges – Why I Love Basic Auth

Let’s talk about Basic Auth:

It’s a well and clearly defined specification.

It’s been around since ~1996.

It’s super simple.

Here’s the short version of how it works.

You are a developer.

You have an API key pair: an API Key ID and an API Key Secret. Each of these is a randomly generated string (usually a uuid).

To authenticate against an API service, all you need to do is put your credentials…

sometimes im working on something and i want to hide a page because i haven't finished yet. a very very simple way to prevent people from looking inside is to protect the page with basic auth. this can be easily broken through, but it's more of a deterent. it's also useful for sites that are hosted on company intranets, to give certain teams or people access to certain tools or monitoring applications

so lets assume we already have apache installed and running, and it is serving files and webpages/apps or whatever. you have a site you want to protect with basic auth

create an apache password file and set permissions

$ sudo mkdir /etc/htpasswd/ $ sudo chown apache:apache /etc/htpasswd/ $ sudo chmod 500 /etc/htpasswd/ $ sudo htpasswd -c /etc/htpasswd/.htpasswd user $ sudo chown apache:apache /etc/htpasswd/.htpasswd $ sudo chmod 400 /etc/htpasswd/.htpasswd

the htpasswd -c command creates a .htpasswd file with a user inside. you will be prompted for a password for the user after entering this command. if you want to add additional users, do the same again but drop the -c option

$ sudo htpasswd /etc/htpasswd/.htpasswd anotheruser

to configure the server to know who is allowed from the htpasswd file, put the below into the tags in the httpd.conf file for the web root and/or cgi-dir root of your website/app

$ vim /etc/httpd/conf/httpd.conf <Directory "/var/www/html/"> # # Controls who can get stuff from this server. # AuthType Basic AuthName "Authentication Required" AuthUserFile "/etc/htpasswd/.htpasswd" Require valid-user </Directory> # # "/var/www/cgi-bin" should be changed to whatever your ScriptAliased # CGI directory exists, if you have that configured. # <Directory "/var/www/cgi-bin"> AllowOverride None Options None AuthType Basic AuthName "Authentication Required" AuthUserFile "/etc/htpasswd/.htpasswd" Require valid-user AddHandler default-handler .html .htm </Directory>

Note to self : If a REST Message requiring Basic Auth doesn’t work, maybe don’t use ServiceNow Basic Auth functionality at all, and manually and painfully write up the Basic Auth data into Rest Message Function Headers.

Because that will work some times.