I am familiar with the basic workings of HTTP Auth, but how does it keep track of authentication between page views? I see there is no cookie created when the initial authentication takes place.

2 Answers 2


To quote the Wikipedia article on this:

Because the BA header has to be sent with each HTTP request, the web browser needs to cache credentials for a reasonable period of time to avoid constantly prompting the user for their username and password.

So it seems your browser takes care of this for you.


A client SHOULD assume that all paths at or deeper than the depth of
the last symbolic element in the path field of the Request-URI also
are within the protection space specified by the Basic realm value of the current challenge. A client MAY preemptively send the
corresponding Authorization header with requests for resources in
that space without receipt of another challenge from the server.

Source: RFC 2617: HTTP Authentication: Basic and Digest Access Authentication

So the client/browser should handle this in some way per realm.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .