Cookie 与基本身份验证
为什么几乎所有网站都使用 cookie 而不是基本身份验证？ 不仅仅是用户/密码窗口很丑陋，而且它们都更安全。它们都是不安全的（没有 https）。
Why almost all websites out there are using cookies instead of basic auth?
It can't be only that the user/pass window is ugly and none of them is more secure. They are both insecure (without https).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
要注销基本身份验证登录，通常需要完全退出浏览器。这意味着服务器无法注销用户。
我相信基本身份验证也有更多的开销（假设你的cookie大小不是很大），但我可能是错的。
HTTP 基本身份验证还会在每次请求时发送用户名和密码，这可能会降低安全性，因为有更多的机会被拦截。
To logout of a basic auth login the browser often needs to be quit entirely. This means there is no way for the server to log out the user.
I believe basic auth also has more overhead (assuming your cookie size isn't massive), but I might be wrong about that.
HTTP basic auth also sends the username and password with every request, making it potentially less secure because there is more opportunity for interception.
您对 cookie 有更多控制权。您可以对它们进行加密，这样即使没有 HTTPS，它们也是安全的。 HTTP 上的基本身份验证始终不安全。此外，Cookie 不包含每个请求的密码。是的，我能说什么，用户喜欢 AJAX 登录表单和登录时漂亮的动画效果，遗憾的是无法通过基本身份验证实现。
You have more control over cookies. You can encrypt them so that they are secure even without HTTPS. Basic auth is always unsecure over HTTP. Also cookies don't contain the password on each request. And, yes, what can I say, users like AJAX login forms and nice animated effects when logging in which unfortunately cannot be achieved with basic auth.
使用 cookie，您可以完全控制何时对用户进行身份验证，而不是一有请求就进行身份验证。
另外，您也不必对图片进行身份验证
另一件事是您不必依赖系统管理员进行身份验证。
您还可以选择带有会话的用户存储库。
还有其他事情。正如您所说，两者或多或少都安全，所以为什么不灵活选择呢？为了向客户展示网站，我们经常使用服务器身份验证，因为它很简单并且是一个全球解决方案。对于应用程序内的表单，我们使用 cookie。
With cookies you have the complete control on when to authenticate the user, its not as soon as theres a request.
Plus you dont have to authenticate for pictures as well
Another thing is that you dont have to rely on a sysadmin for auth.
You also have the choice regarding the users repository with session.
There are other things. As you said, both are more or less secure so why not opt with flexibility? To showcase sites to clients we often use server auth as it is easy and a global solution.. for forms within apps, we use cookies.