Basic Auth

A librarian writes a quick script to export overdue loans every night. BookNook needs to know the script is allowed to see them. The oldest and simplest answer HTTP offers is Basic authentication: send a username and password with every request. It is easy to understand, which makes it a good place to learn what every other method improves on.

The rule

Basic auth is a password on every request, merely encoded, never encrypted.

First, two words that sound alike:

• Authentication answers "who are you?"
• Authorization answers "what may you do?"

This section is about the first. A failed authentication is 401; a known caller who is not allowed is 403.

With Basic auth, the client joins username and password with a colon, encodes the result in Base64, and sends it in the Authorization header:

bGlicmFyaWFuOnMzY3JldA== decodes straight back to librarian:s3cret. Base64 is an encoding, like writing in a different alphabet, not a lock. Anyone who sees the header has the password.

When credentials are missing or wrong, the server answers:

WWW-Authenticate tells the client which scheme to use.

Because of how it works:

• It is only acceptable over HTTPS, which encrypts the whole request.
• The real password travels on every request, so every request is a chance to leak it.
• There is no logout and no expiry: the credential stays valid until the password changes.
• The server must check the password on every call. Stored passwords should be hashed with a slow algorithm such as Argon2 or bcrypt, which makes each check deliberately costly.

Basic auth still suits simple internal tools, or an API key sent as the username. For users and apps, token-based methods are safer.

The shortcut

Judge any auth method with three questions: What travels? How long is it valid? How do I revoke it?

The trap is thinking Base64 hides the password. It is as readable as plain text to anyone who looks.

Drills

Answer fast — trust the rule.

Remember

• Basic auth is a password on every request, merely encoded, never encrypted.
• Shortcut: what travels, how long is it valid, how do I revoke it?
• Trap: treating Base64 as protection, or using Basic auth without HTTPS.