Why does your API still use HTTP Basic Auth?
Isn't this is a problem with the client, curl in this case? According to the spec:> HTTP provides a simple challenge-response authentication mechanism which may be used by a server to challenge a client request and by a client to provide authentication information.The client should make two requests. The first with no credentials to see if the resource is protected (the challenge part). The server will then respond with a 401 Unauthorised status and a WWW-Authenticate header indicating what authentication to use. The client will then make another request with the given authentication.The insecurity is caused by curl not doing this challenge response, it is just sending the credentials straight away.