Basic access authentication
HTTP Basic authentication (BA) implementation is the simplest technique for enforcing access controls to web resources because it doesn't require cookies, session identifiers, or login pages; rather, HTTP Basic authentication uses standard fields in the HTTP header, obviating the need for handshakes.
The BA mechanism provides no confidentiality protection for the transmitted credentials. They are merely encoded with Base64 in transit, but not encrypted or hashed in any way. HTTPS is, therefore, typically preferred used in conjunction with Basic Authentication.
Because the BA field has to be sent in the header of each HTTP request, the web browser needs to cache credentials for a reasonable period of time to avoid constantly prompting the user for their username and password. Caching policy differs between browsers. Microsoft Internet Explorer by default caches them for 15 minutes.
HTTP does not provide a method for a web server to instruct the client to "log out" the user. However, there are a number of methods to clear cached credentials in certain web browsers. One of them is redirecting the user to a URL on the same domain containing credentials that are intentionally incorrect.
When the server wants the user agent to authenticate itself towards the server, it must respond appropriately to unauthenticated requests.
The WWW-Authenticate field for basic authentication (used most often) is constructed as following:
WWW-Authenticate: Basic realm="User Visible Realm"
When the user agent wants to send the server authentication credentials it may use the Authorization field.
- The username and password are combined with a single colon.
- The resulting string is encoded using the RFC2045-MIME variant of Base64, except not limited to 76 char/line.
- The authorization method and a space i.e. "Basic " is then put before the encoded string.
For example, if the user agent uses Aladdin as the username and OpenSesame as the password then the field is formed as follows:
echo -n "Aladdin:OpenSesame" | base64
.. yields a string 'QWxhZGRpbjpPcGVuU2VzYW1l' that is used like so:
(The -n makes sure there's not an extra newline being encoded)
Authorization: Basic QWxhZGRpbjpPcGVuU2VzYW1l
See that back as plain-text, like so:
echo "QWxhZGRpbjpPcGVuU2VzYW1l" | base64 --decode
A client may avoid a login prompt when accessing a basic access authentication by prepending
username:password@ to the hostname in the url. For example, the following would access the page index.html at the web site www.example.com with the secure HTTPS protocol and provide the username Aladdin and the password OpenSesame credentials via basic authorization:
https://Aladdin:OpenSesame@www.example.com/index.html This method may not work in all browsers.
- Digest access authentication
- HTTP header
- TLS-SRP, an alternative if one wants to avoid transmitting a password-equivalent to the server (even encrypted, like with TLS).
References and notes
- "Basic Authentication". Microsoft. 2005. Retrieved October 17, 2014.
- "Is there a browser equivalent to IE's ClearAuthenticationCache?". StackOverflow. Retrieved March 15, 2013.
- "IDM_CLEARAUTHENTICATIONCACHE command identifier". Microsoft. Retrieved March 15, 2013.