Using HTTPS for client-server communication

Question

I would like to use HTTPS to provide communication between my client and server. The first encrypted message will be used to authenticate the user, that is, checking his / her username and password.

After the user credentials are successfully verified by the server, I would like to start receiving some data in subsequent requests. BUT, how will the server determine that a subsequent request is sent by a user whose credentials have already been verified?

Since the TCP connection can be closed between the login and subsequent HTTPS requests (I think), this means that the SSL context must be released by the server, therefore, with a new GET request, a new TCP connection must be established and a new SSL connection must be made (TLS) (i.e., a new shared password for encryption must be exchanged by both parties, etc.)

To do this, I think that the server needs to send 200 OK back to the client for the initial authentication request of some randomly generated nonce (which is valid for a certain time), which I will include in each subsequent request, so the server can determine based on this randomly generated nonce whose name is behind the request and verify that this user is already registered. Do I understand correctly?

Thanks a lot for the answer BR Stan

Answer 1

The easiest way is to require that all communication go through HTTPS (therefore, the data is confidential, no one except the client and server can see this), and use a simple username and password for each request inside this secure connection. This is practically impossible to do in practice (the username and password do transmit the connection as an HTTP header, which is OK, because we use HTTPS), and the server can check every time the user is allowed. You do not need to worry about SSL handshakes; what is responsible for the SSL / HTTPS level (and why is HTTPS / SSL good).

Alternatively, the login can be performed by any method and generate some kind of magic number (for example, a UUID or a cryptographic hash of a random number and username), which is stored in the session cookie. Subsequent requests can simply verify that the magic number is the one that it recognizes from the beginning of the session (and that too much time has passed since it was issued); logout just forgets the magic number on the server side (and asks the client to forget too). This is a bit more work to implement this, but still not difficult, and there are libraries for the server side to handle donkey work.

The first option is especially good for where you write something that will be used by other programs, since it is very easy to implement. The second option is better when the client is a web browser, as it gives users more control when their browser is enabled (software APIs are not really needed). Whenever the client will be a browser, you also need to take care of protection against other types of attacks (for example, various types of fake requests), but this is practically independent of everything else.

Answer 2

Inventing a custom authentication mechanism in your case is very risky - it’s easy to make a mistake that will allow you to make many mistakes. So the right approach, like me, is to use HTTPS and pass in user credentials with every request.