Hey HN! I&#x27;m designing a(nother) API and I have a question for the more security-savvy users here. If I put my API on HTTPS and refuse insecure clients, is there any risk in doing authentication as a username:password authentication header instead of using tokens? I&#x27;ve used sessions and tokens in the past and the complexity of implementation makes me question if it&#x27;s needed. What do you guys think? Is this safe? It <i>feels</i> unsafe in my gut, but in principle I can&#x27;t think of anything wrong with it as long as everything happens over SSL. Please correct me if i&#x27;m mistaken.
Ask HN: Vulnerabilities with Basic Auth in Header Over SSL?