Basic access authentication
lastmod 2026-03-04created 2017-12-079 edits
In the context of an HTTP transaction, basic access authentication is a method for an HTTP user agent to provide a user name and password when making a request.
Categories
Protocol
Server side
When the server wants the user agent to authenticate itself towards the server, the server must respond appropriately to unauthenticated requests.
To unauthenticated requests, the server should return a response whose header contains a HTTP 401 Unauthorized status and a WWW-Authenticate field.
The WWW-Authenticate field for basic authentication (used most often) is constructed as following:
Client side
When the user agent wants to send authentication credentials to the server, it may use the Authorization field.
The Authorization field is constructed as follows:
The username and password are combined with a single colon. (:) The resulting string is encoded into an octet sequence. The resulting string is encoded using a variant of Base64. The authorization method and a space (e.g. "Basic ") is then prepended to the encoded string, separated with a space. For example, if the browser uses Aladdin as the username and OpenSesame as the password, then the field's value is the base64-encoding of Aladdin:OpenSesame, or QWxhZGRpbjpPcGVuU2VzYW1l. Then the Authorization header will appear as:
Is Basic authentication running over HTTPS secure?
Authentication and security are separate issues. HTTPS handles security, and Basic handles authentication. So if HTTPS is secure, it is secure. However, assuming HTTPS is breached, it is not secure.