Why avoid HTTP Authentication?

[awhitford]

From 12.4.7. HTTP Authentication, the Seam docs say:

Although not recommended for use unless absolutely necessary, Seam provides means for authenticating using
either HTTP Basic or HTTP Digest (RFC 2617) methods.

Can someone elaborate on why HTTP authentication is meant to be avoided?

[modoc]

The lack of logoff ability (short of closing the browser) is one issue. You also have to pass the auth headers with each request, instead of having auth linked to a session (is this true with jboss? I don't know for sure.)

And for customer/user facing applications, having a login form integrated within your design is usually preferable.

Those are my thoughts at any rate...

[hstang]

Here's a resource on this topic.

http://pdf.moreservlets.com/More-Servlets-and-JSP-Chapter-07.pdf