Working on a side-project writing an API and when it comes to authentication I am a little stuck. I am trying to decide what the differences between using Basic Auth vs $_POST fields for the actual login.

Once the login gets posted, I will return a token to the client that will then be used on subsequent API calls.

My plan looks like this:

  1. User enters username, password on client login form
  2. Client will hash the password
  3. Client will send username and hashed password to API TokenController over SSL

  4. TokenController will hash password again and verify credentials against the database

  5. If valid, returns a JWT and valid response to the client
  6. If invalid, returns invalid response to client.

  7. Client uses returned token to make other API calls like users/{id}

Only on the initial login will the credentials be sent in somewhat cleartext (they will be hashed). I think I could go with Basic Auth or sending as a normal POST and it would work fine.

Would either one work in this case?

  • What are you doing with the password? Storing it in plain text on the server? Or a hash of a hash? Commented Jul 17, 2017 at 17:06
  • @RibaldEddie hash of a hash
    – keelerjr12
    Commented Jul 17, 2017 at 17:07

1 Answer 1


Yes, either one would work. A more appropriate one would probably be the POST since basic auth isn't really used as a one time thing / token exchange mechanism.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.