Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How does basic HTTP Auth work?

share|improve this question
Explained very well on the wikipedia page unless there is something you don't understand - – Mark Davidson Nov 23 '10 at 14:29
Wikipedia 4tw! :) – Chris Dale Nov 23 '10 at 17:14
@Ams - Implementations and mechanisms are very related to security, as they can be used in researching exploits. I asked this specifically because of a comment on this answer:… – Moshe Nov 23 '10 at 18:37
@Moshe, I think SE IT security is more about practical approach, rather than something that requires reading RFC, tech notes and manuals. Similarly to this question, we can generate a lot of others questions regarding "how stuff works" - e.g. "how SOP is implemented", "how web-server works". At some point they are also related to security. But IMO, these are those questions that are not reasonable to ask community - something that is possible to get easy on your own or through little research. – anonymous Nov 23 '10 at 19:18
@makerofthings the stackexchange team disagrees with you:… – user185 Nov 23 '10 at 22:38
up vote 11 down vote accepted

The server sends back a header stating it requires authentication for a given realm. The user provides the username and password, which the browser concatenates (username + ":" + password), and base64 encodes. This encoded string is then sent using a "Authorization"-header on each request from the browser. Because the credentials are only encoded, not encrypted, this is highly insecure unless it is sent over https.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.