这是对用户进行身份验证的安全方式吗？

Question

I am running a small local HTTP server that allows me to manage config files via GET requests. However, this action should require a password, so I came up with the following solution:

Let's say the password is test123 . I hashed the password using SHA-512 and saved it to a.txt-file on my web server. When I want to get the config file main.json , I would send this request:

http://192.168.178.72/config.php?mode=get&file=main&password=test123

Is this a secure way of doing it?

Answer 1

No, because as you can see, the credentials are being displayed on the url, use POST instead.

Answer 2

No, you should use https instead and a POST request to avoid printing the passphrase in the url.

As long as you use http, every connection or connection attempt could suffer under a man-in-the-middle attack. Use of https and proper certificate pinning could avoid this