If using Basic security under an SSL connection (https), is is not true that the server matches the user/password combination, but what happens after that? What prevents the browser from accessing the server? Does the browser enter an "authenticated" state, allowing it to access the server? Or, does the server somehow offer a different channel to the browser, once authenticated?
I ask this because if any of the responsibility of authentication is entrusted to the browser, then what if we have a renegade/profligate browser that doesn't follow the rules. Conceivably, a modified browser could get you into anything by bypassing the final authentication. I wonder what it is on the server side that determines if a user is "authenticated", and what changes that allows http transactions to take place.
Note that this assumes that user/password has been securely transmitted using ssl, but questions the trustability of the browser if it is the authentication agent.
In other words, who is the gatekeeper (i.e., the one that can deny access) - the server or the browser? If it is the server, are credentials or some sort of authentication key passed on each independent transaction? Or, if it is the browser, is the server vulnerable to a "profligate" browser - e.g., one that has been modified - that can allow access without authentication?
Can anyone shed some light on this?