How does basic HTTP Auth work?

  • 9
    Explained very well on the wikipedia page unless there is something you don't understand - en.wikipedia.org/wiki/Basic_access_authentication Nov 23, 2010 at 14:29
  • 2
    @Ams - Implementations and mechanisms are very related to security, as they can be used in researching exploits. I asked this specifically because of a comment on this answer: security.stackexchange.com/questions/730/…
    – Moshe
    Nov 23, 2010 at 18:37
  • 1
    @Moshe, I think SE IT security is more about practical approach, rather than something that requires reading RFC, tech notes and manuals. Similarly to this question, we can generate a lot of others questions regarding "how stuff works" - e.g. "how SOP is implemented", "how web-server works". At some point they are also related to security. But IMO, these are those questions that are not reasonable to ask community - something that is possible to get easy on your own or through little research.
    – anonymous
    Nov 23, 2010 at 19:18
  • 1
    @makerofthings the stackexchange team disagrees with you: blog.stackoverflow.com/2010/07/…
    – user185
    Nov 23, 2010 at 22:38
  • 1
    Thanks Gram for showing me a new perspective; I just removed my comment above. Nov 23, 2010 at 23:35

2 Answers 2


The server sends back a header stating it requires authentication for a given realm. The user provides the username and password, which the browser concatenates (username + ":" + password), and base64 encodes. This encoded string is then sent using a "Authorization"-header on each request from the browser. Because the credentials are only encoded, not encrypted, this is highly insecure unless it is sent over https.


The server sends a request to the user for the authentication for the site, the user provides the username and password, the browser rearranges it to be (username + ":" + password), and encodes it, the encoded password is then sent to the server and lets you in if correct

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .