title: Login user via GET (basic auth header) or POST
body: <p>I've been doing some HTTP methods and header research recently if we should use <code>GET</code> with basic authorization instead of POST when submitting?</p>
  <p><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods" rel="nofollow noreferrer">HTTP Methods</a></p>
  <blockquote>
  <p>The GET method requests a representation of the specified resource. Requests using GET should only retrieve data.</p>
  </blockquote>
  <blockquote>
  <p>The POST method submits an entity to the specified resource, often causing a change in state or side effects on the server.</p>
  </blockquote>
  <p>As we see here, the POST method normally changes the state of the server. If sending out JWTs/HTTP cookies, we are not modifying the state of the server. Nor are we creating a new resource in the server.</p>
  <p>I understand that we should not not send the username and password as a GET parameter but should we use the <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization" rel="nofollow noreferrer">authorization header</a> instead?</p>
  <blockquote>
  <p>Basic authentication
  For &quot;Basic&quot; authentication the credentials are constructed by first combining the username and the password with a colon (aladdin:opensesame), and then by encoding the resulting string in base64 (YWxhZGRpbjpvcGVuc2VzYW1l).
  <code>Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l</code></p>
  </blockquote>
  <p>The only advantage I see to using POST over GET is that we need no extra code in the HTML/JS on the client side to send headers via the <code>fetch</code> API. To send headers, we would need an <code>onsubmit</code> and then check if status code is 200. If 200, we will need to redirect to the page after the login screen. Then again, if using the fetch API, this means the server does not need to send a new HTML page to the client all the time either.</p>
  <p>Should we use GET with basic auth or POST when logging in since we don't create a resource/modify the server state?
  Would this change if say we enable 2FA since we would need to generate a code for that user?</p>