If using Basic security under an SSL connection (https), is is not true that the server matches the user/password combination, but what happens after that? What prevents the browser from accessing the server? Does the browser enter an "authenticated" state, allowing it to access the server? Or, does the server somehow offer a different channel to the browser, once authenticated?

I ask this because if any of the responsibility of authentication is entrusted to the browser, then what if we have a renegade/profligate browser that doesn't follow the rules. Conceivably, a modified browser could get you into anything by bypassing the final authentication. I wonder what it is on the server side that determines if a user is "authenticated", and what changes that allows http transactions to take place.

Note that this assumes that user/password has been securely transmitted using ssl, but questions the trustability of the browser if it is the authentication agent.

In other words, who is the gatekeeper (i.e., the one that can deny access) - the server or the browser? If it is the server, are credentials or some sort of authentication key passed on each independent transaction? Or, if it is the browser, is the server vulnerable to a "profligate" browser - e.g., one that has been modified - that can allow access without authentication?

Can anyone shed some light on this?

  • The server checks each request. Typically it looks for a known Session cookie and if this is missing or expired it looks for the authentication header sent by the browser on each request.
    – eckes
    May 20 '17 at 23:25
  • Thanks to all. It sounds like the server is the Gatekeeper, which is relieving since if it were the browser it could misbehave and the server would be trusting the untrustable.
    – Dave Retz
    May 22 '17 at 5:13

With Basic Authentication the username and password is send with each HTTP request to the server. But, the browser will not ask you again and again for each request because it simply uses the same credentials you've already entered as long the authentication succeeds.

This is similar if you give somebody the key to your house. You give the key once and the person (browser) will use it always to open the door (i.e. authorize against the server). Only if you change the lock (i.e. change password or similar) the original key will not work any longer and the person needs a new one. The person does not enter an authorized state in any way, it is just that the person has the key matching the lock.

EDIT: since the comment showed that it was not fully clear. The server never trusts the browser unless it can provide the authentication credentials. Thus it will not help to modify the browser. This is the same with the lock in the door: it will never open just for a person no matter how this person looks like. Instead the lock will only open for the person having and using the correct key.

  • Yes, the browser can retain the credentials once successfully verified. But my question is, what if the browser were modified (via changes to the source code, for example) in some way to bypass the authentication procedure? Does the server re-authenticate on each access to the protected directory, or does the browser, once authenticated, happily provide access to the server? In other words, who is the gatekeeper (one that can refuse access) - the browser or the server?
    – Dave Retz
    May 20 '17 at 22:33
  • @DaveRetz the server, it holds the directory, and can change the key.
    – Οurous
    May 20 '17 at 23:13
  • 1
    @DaveRetz The browser is never trusted by the server unless it provides a username/password combination. There's no way to modify source code of the browser to get past the authentication since it's the server that's checking that every request from every browser is valid. May 21 '17 at 0:22
  • @DaveRetz: hope the edit of the answer makes this more clear now. May 21 '17 at 5:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.