I have been reading about the different authentication types - form, basic, digest and client-cert and I have a basic doubt. It says that form and basic methods are not secure. Digest method is not supported by all containers. Client-cert is the only one left, but it requires client side certificates. Suppose I want an aunthentication method which is secure, but I don't want to go into the hassle of client side certificates etc. then which one would I choose ? For example, my bank uses JSPs in their online banking system. It is secure (encrypted etc), but no cient side certificates or anything is used. How would they be managing that ? Same way for all these e-mail sites, where security is very important.