What is Basic Authentication?

Basic authentication is the simplest method of HTTP client authentication, defined in RFC 7617.

Working principle:

1. The client sends an HTTP request to a protected resource.
2. The server responds with a 401 Unauthorized status and a WWW-Authenticate: Basic realm="<realm>" header, where <realm> is a text description of the protected area (resource).
3. The browser or client application displays a dialog box for entering the username and password.
4. The client encodes the username and password into a string in the format username:password.
5. The resulting string is encoded using Base64.
6. The client repeats the request, adding the header Authorization: Basic <base64_encoded_string>, where <base64_encoded_string> is the Base64 encoding result.
7. The server decodes the Base64 string, separates the username and password, and verifies the credentials.
8. If the credentials are correct, the server sends the requested resource. Otherwise, it again returns 401 Unauthorized.

Example of an Authorization header:

Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l

where YWxhZGRpbjpvcGVuc2VzYW1l is the Base64-encoded string aladdin:opensesame.

Features:

• Simplicity: Easy to implement on both client and server sides.
• Insecurity: Credentials are transmitted, albeit in Base64-encoded form, but not encrypted. Base64 is encoding, not encryption. When traffic is intercepted, data can be easily decoded. Only in conjunction with HTTPS does it provide a minimal level of security.
• Stateless: Does not maintain state on the server between requests (stateless). Each request requires the Authorization header.
• User experience: Browser dialog box is less flexible and user-friendly compared to custom authentication forms.

Usage: Most often used to protect APIs, static resources, or in simple internal systems where security is not critically important, or must be combined with SSL/TLS (HTTPS).