HTTPS and plaintext authentication I have client connecting a server over HTTPS to send and retrieve data.


The client always connects through HTTPS
The certificate is known to the client beforehand (hard coded into the software)
The password is auto-generated, so not chosen by the client


For authentication, is there any reason I should do anything more complicated than sending username + password in plaintext over the HTTPS connection for every request?

The data is encrypted by the HTTPS layer, so I am not vulnerable, right?
Given your ideal setup, I don't think you need anything else than plaintext authentication.

The only thing could be if the server at the end of the TLS link is not the one managing the authentication (in which case you do not necessarily want to reveal to it your password).