Where exactly in an HTTP request should authentication data such as login and password be specified?

Authentication data such as login and password are usually transmitted in the HTTP request header Authorization. The most common method is to use Basic Authentication scheme, where login and password are Base64-encoded and sent in the header:

Authorization: Basic base64(login:password)

For example, if login is user and password is pass, the string to encode will be user:pass.

Example in Android using HttpURLConnection:

String credentials = "user:pass";
String auth = "Basic " + Base64.encodeToString(credentials.getBytes(), Base64.NO_WRAP);
connection.setRequestProperty("Authorization", auth);

Passing login and password in the request body or in the URL (e.g., in GET parameters) is not recommended for security reasons.