How does HTTP Basic Auth persist across pageviews?

Question

I am familiar with the basic workings of HTTP Auth, but how does it keep track of authentication between page views? I see there is no cookie created when the initial authentication takes place.

Answer 1

To quote the Wikipedia article on this:

Because the BA header has to be sent with each HTTP request, the web browser needs to cache credentials for a reasonable period of time to avoid constantly prompting the user for their username and password.

So it seems your browser takes care of this for you.

Answer 2

A client SHOULD assume that all paths at or deeper than the depth of
the last symbolic element in the path field of the Request-URI also
are within the protection space specified by the Basic realm value of the current challenge. A client MAY preemptively send the
corresponding Authorization header with requests for resources in
that space without receipt of another challenge from the server.

Source: RFC 2617: HTTP Authentication: Basic and Digest Access Authentication

So the client/browser should handle this in some way per realm.