search

Basic Access Authentication

Or RFC 7617 (replacing RFC 2617)

GlobalSCAPE Knowledge Basekb.globalscape.comchevron-right

From Wikipedia:

HTTP Basic authentication (BA) implementation is the simplest technique for enforcing access controlsarrow-up-right to web resources because it does not require cookiesarrow-up-right, session identifiers, or login pages; rather, HTTP Basic authentication uses standard fields in the HTTP headerarrow-up-right.

User credentials is ALWAYS passed for each requests.

Below is complete flow of BA.

On first, a pop-up dialog ask for username/password to input.

Of note, is that second request to /api/v1/students/2, does no longer pop-up the auth dialog, but the browser is responsible for still attaching to the request the same credentials because the browser caches the credentials as it is needed for each request.

Of note, also is that BA has no /logout concept since there is no caching, so there is nothing to clear.

Take note, that Form-based Authentication was invented as an improvement of BA because Form-based auth has a /logout concept which clears the cache. In the BA, the browser caches the credentials, so this is a security issue, despite the spec stated that caching is not part of the protocol.

PreviousForm-based AuthenticationNextJWT Authentication

Last updated

Was this helpful?