Why does your API still use HTTP Basic Auth?
Isn't this is a problem with the client, curl in this case? According to the spec:<p>> HTTP provides a simple challenge-response authentication mechanism which may be used by a server to challenge a client request and by a client to provide authentication information.<p>The client should make two requests. The first with no credentials to see if the resource is protected (the challenge part). The server will then respond with a 401 Unauthorised status and a WWW-Authenticate header indicating what authentication to use. The client will then make another request with the given authentication.<p>The insecurity is caused by curl not doing this challenge response, it is just sending the credentials straight away.