How does basic HTTP Auth work?
6
-
9Explained very well on the wikipedia page unless there is something you don't understand - en.wikipedia.org/wiki/Basic_access_authentication– Mark DavidsonNov 23, 2010 at 14:29
-
2@Ams - Implementations and mechanisms are very related to security, as they can be used in researching exploits. I asked this specifically because of a comment on this answer: security.stackexchange.com/questions/730/…– MosheNov 23, 2010 at 18:37
-
1@Moshe, I think SE IT security is more about practical approach, rather than something that requires reading RFC, tech notes and manuals. Similarly to this question, we can generate a lot of others questions regarding "how stuff works" - e.g. "how SOP is implemented", "how web-server works". At some point they are also related to security. But IMO, these are those questions that are not reasonable to ask community - something that is possible to get easy on your own or through little research.– anonymousNov 23, 2010 at 19:18
-
1@makerofthings the stackexchange team disagrees with you: blog.stackoverflow.com/2010/07/…– user185Nov 23, 2010 at 22:38
-
1Thanks Gram for showing me a new perspective; I just removed my comment above.– makerofthings7Nov 23, 2010 at 23:35
|
Show 1 more comment
2 Answers
The server sends back a header stating it requires authentication for a given realm. The user provides the username and password, which the browser concatenates (username + ":" + password), and base64 encodes. This encoded string is then sent using a "Authorization"-header on each request from the browser. Because the credentials are only encoded, not encrypted, this is highly insecure unless it is sent over https.
The server sends a request to the user for the authentication for the site, the user provides the username and password, the browser rearranges it to be (username + ":" + password), and encodes it, the encoded password is then sent to the server and lets you in if correct
