What is basic authentication?

Basic Authentication is an HTTP authentication method where the client sends the username and password encoded in the HTTP request header.

Working mechanism:

1. The client sends a request to a protected resource without credentials.
2. The server responds with a 401 Unauthorized status code and a WWW-Authenticate: Basic realm="[realm]" header, where [realm] describes the access area.
3. Upon receiving the 401 response and the WWW-Authenticate header, the client prompts the user to enter a login and password.
4. The client encodes the credentials in base64 format: base64(username:password).
5. The client resends the request to the server with the header Authorization: Basic <encoded_credentials>.
6. The server decodes the credentials, verifies them, and if successful, grants access to the resource.

Authorization header format:

Authorization: Basic <base64(username:password)>

Example:

Authorization: Basic c29tZXVzZXI6c29tZXBhc3N3b3Jk

Where c29tZXVzZXI6c29tZXBhc3N3b3Jk is the base64 encoding of the string someuser:somepassword.

Features:

• Simple implementation: Easy to configure on both client and server sides.
• Insecurity: Credentials are transmitted in a form that is easily decoded (base64 is encoding, not encryption). It is strongly discouraged to use without HTTPS/SSL/TLS to protect the communication channel.
• Transmission with each request: Credentials are sent with every request to the protected resource.

Basic Authentication is most often used in combination with HTTPS to ensure the confidentiality of transmitted credentials.