Http- Secrity- Form Based Authentication

First of all form-based authentication is not an http specification. Http specification only supports Basic and Digest authentication. Form based authentication is servlet specific.

In form based authentication, user is presented one page in which we have the username and password text boxes. User fills in the details and submits the form. This information will travel over the network.

If for some reasons we can not use SSL, then it is not advised to use form-based authentication. As the username and password will travel over the network in plain text and can easily be retrieved. ( Not sure how easily though, I have got no experience with network sniffing. But it will be interesting to check this out though).

One will use the form-based authentication only when he is unhappy with the pop-up that the browser throws if we use Basic or Digest Authentication. But if we can not use SSL then I guess it is better to accept Basic/Digest dialog box than to provide form based authentication. In Basic/Digest authentication the password will not travel as plain text.

If we are using SSL then any authentication can be used. Because the complete channel between the client and server will be encrypted. And nothing will be transmitted as plain text.