How does basic HTTP Auth work?

  • 9
    Explained very well on the wikipedia page unless there is something you don't understand - en.wikipedia.org/wiki/Basic_access_authentication – Mark Davidson Nov 23 '10 at 14:29
  • 2
    @Ams - Implementations and mechanisms are very related to security, as they can be used in researching exploits. I asked this specifically because of a comment on this answer: security.stackexchange.com/questions/730/… – Moshe Nov 23 '10 at 18:37
  • 1
    @Moshe, I think SE IT security is more about practical approach, rather than something that requires reading RFC, tech notes and manuals. Similarly to this question, we can generate a lot of others questions regarding "how stuff works" - e.g. "how SOP is implemented", "how web-server works". At some point they are also related to security. But IMO, these are those questions that are not reasonable to ask community - something that is possible to get easy on your own or through little research. – anonymous Nov 23 '10 at 19:18
  • 1
    @makerofthings the stackexchange team disagrees with you: blog.stackoverflow.com/2010/07/… – user185 Nov 23 '10 at 22:38
  • 1
    Thanks Gram for showing me a new perspective; I just removed my comment above. – halfbit Nov 23 '10 at 23:35

The server sends back a header stating it requires authentication for a given realm. The user provides the username and password, which the browser concatenates (username + ":" + password), and base64 encodes. This encoded string is then sent using a "Authorization"-header on each request from the browser. Because the credentials are only encoded, not encrypted, this is highly insecure unless it is sent over https.


The server sends a request to the user for the authentication for the site, the user provides the username and password, the browser rearranges it to be (username + ":" + password), and encodes it, the encoded password is then sent to the server and lets you in if correct

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.