Where exactly in the structure of an HTTP request are the login and password usually specified for authentication?

Login and password for authentication in an HTTP request are usually specified in the Authorization header. In the case of basic authentication (Basic Auth), the data is transmitted as a string encoded in Base64, for example:

Authorization: Basic base64(username:password)

This allows the server to recognize the user and verify their access rights. Login and password can also be transmitted in the URL, but this is considered insecure and is not recommended.