I have a website built upon windows IIS and to use password to protect the website and disable anonymous logon to that website, the ONLY way is to disable the anonymous logon in IIS and use a windows login account as website logon account.
However this will cause security leak because the there is no https connection so the windows logon password is transported on the network in "clear text". If anyone captured the password he/she can use it to logon the server. So can we use HTTPS in this case?
Or if we can use https, there is another concern which is that we don't want the website user to logon the server using that same windows account. We only want the user to access the website but not the windows server. Can we disable this particular windows account user to login the windows while allow this user to access the password protected website?