Basic Authentication security level

vrish3 years ago

Hi all,
@Anton, thank you for such a wonderful product.

I'm wondering if anyone has implemented any additional authentication or replaced the standard Basic Authentication that comes out of the box? If yes, can someone point me in the right direction. I have searched through the forums but wasn't able to find anything concrete or specific.

Using Basic Authentication in a web form is obviously very basic as its provided out-of-the-box.

At this point, my thought would be to add something like MD5 / BCrypt and encrypt the payload on the client-side before sending it to the server for authentication so it doesn't get sniffed via a MITM on the wire.

If there are no other implementations available, my guess is that I would have to do a custom build with this additional code for myself.

Thank you
-VK

Anton Tananaev3 years ago

If you are using HTTPS, MITM shouldn't be a problem.

vrish3 years ago

True.

I'm also trying to see how I can add a custom encryption logic from the UI and have that be accepted by the server, primarily for the password field so its sent encrypted on the wire.

I understand that org.traccar.helper.Hashing.java is the class on the server side.

I'm having a bit of difficulty in deciphering the web side. Can you point me in the right direction @Anton?

Anton Tananaev3 years ago

There's a Login class. That's probably what you are looking for.