Authenticating connections
In conjunction with establishing client session objects, a Node server often demands authentication credentials. The theory and practice of web security is extensive. We want to simplify our understanding into two main authentication scenarios:
- When the wire protocol is HTTPS
- When it is HTTP
The first is naturally secure, and the second is not. For the first, we will learn how to implement Basic authentication in Node, and for the second, a challenge-response system will be described.
Basic authentication
As mentioned, Basic authentication sends plain text over the wire containing a username/password combination, using standard HTTP headers. It is a simple and well-known protocol. Any server sending the correct headers will cause any browser to display a login dialog, like the following one:
Nonetheless, this method remains insecure, sending non-encrypted data in plain text over the wire. For the sake of simplicity, we will demonstrate this authentication method on an...
