How does basic HTTP Auth work?
The server sends back a header stating it requires authentication for a given realm. The user provides the username and password, which the browser concatenates (username + ":" + password), and base64 encodes. This encoded string is then sent using a "Authorization"-header on each request from the browser. Because the credentials are only encoded, not encrypted, this is highly insecure unless it is sent over https.
The server sends a request to the user for the authentication for the site, the user provides the username and password, the browser rearranges it to be (username + ":" + password), and encodes it, the encoded password is then sent to the server and lets you in if correct