Basic access authentication: Difference between revisions

Revision as of 20:59, 13 December 2023

Latest revision as of 20:05, 24 August 2025

(41 intermediate revisions by 32 users not shown)

Line 1:

{{Short description|Access control method for the HTTP network communication protocol}}

{{HTTP}}

In the context of an [[HTTP]] transaction, '''basic access authentication''' is a method for an [[User agentAgent Profiling|HTTP user agent]] (e.g., a [[web browser]]) to provide a [[usernameuser name]] and [[password]] when making a request. In basic HTTP authentication, a request contains a header field in the form of <code>Authorization: Basic <&lt;credentials></code>, where <code>&lt;credentials></code> areis the [[Base64]] encoding of ID and password joined by a single colon <code>:</code>.

It was originally implemented by [[Ari DuotonesLuotonen]] at [[CERN]] in 1993<ref>{{cite mailing list |URLurl=http://1997.webhistory.org/www.lists/www-talk.1993q3/0882.html |title=Announcing Access Authorization Documentation |date=10 September 2022 |access-date=7 February 2022 |mailing-list=[e-mail] |last=DuotonesLuotonen |first=Ari}}</ref> and defined in the HTTP 1.0 specification in 1996.<ref>{{cite web |URLurl=https://www.w3.org/Protocols/HTTP/1.0/spec.html#BasicAA |title=Hypertext Transfer Protocol -- HTTP/1.0 |date=19 February 1996 |website=www.w3.org |publisher=W3C |access-date=7 February 2022}}</ref>

It is specified in {{IETF RFC|7617}} from 2015, which obsoletes {{IETF RFC|2617}} from 1999.

== Features ==

Line 13 ⟶ 14:

Because the BA field has to be sent in the header of each HTTP request, the web browser needs to [[Cache (computing)|cache]] credentials for a reasonable period of time to avoid constantly prompting the user for their username and password. Caching policy differs between browsers.

HTTP does not provide a method for a web server to instruct the client to “log"log out”out" the user. However, there are a number of methods to clear cached credentials in certain web browsers. One of them is redirecting the user to a URL on the same ___domain, using credentials that are intentionally incorrect. However, this behavior is inconsistent between various browsers and browser versions.<ref name=":0">{{cite web | URLurl=https://stackoverflow.com/questions/31326/is-there-a-browser-equivalent-to-ies-clearauthenticationcache | title=Is there a browser equivalent to IE's ClearAuthenticationCache? | publisher=Stack OverflowStackOverflow | access-date=March 15, 2013}}</ref>{{Better source needed|reason=The current source is user-generated and is insufficiently reliable ([[WP:NOTRS]]).|date=March 2025}} [[Internet Explorer|Microsoft Internet Explorer]] offers a dedicated JavaScript method to clear cached credentials:<ref>{{cite web | URLurl=https://docs.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/hh801226(v=vs.85)#idmclearauthenticationcache | title=<code>IDM_CLEARAUTHENTICATIONCACHE</code> command identifier | publisher=Microsoft | access-date=March 15, 2013}}</ref>

<syntaxhighlight lang="html">

<script>document.execCommand('ClearAuthenticationCache');</script>

</syntaxhighlight>

In modern browsers, cached credentials for basic authentication are typically cleared when clearing browsing history. Most browsers allow users to specifically clear only credentials, though the option may be hard to find, and typically clears credentials for all visited sites.<ref>{{citeCite web|title=540516—Usability540516 - Usability: Allow users to clear HTTP Basic authentication details ('Logout')|URLurl=https://bugzilla.mozilla.org/show_bug.cgi?id=540516|access-date=2020-08-06|website=bugzilla.mozilla.org|language=en|quote=Clear Recent History→ActiveHistory->Active Logins (in the details) is used to clear the authentication.}}</ref><ref>{{citeCite web|title=Clear browsing data —- Computer —- Google Chrome Help|urnurl=https://support.google.com/chrome/answer/2392709?co=GENIE. Platform=DesktopsDesktop&hl=en|access-date=2020-08-06|website=support.google.com|quote=Data that can be deleted[…...] Passwords: Records of passwords you saved are deleted.}}</ref>

Brute forcing credentials is not actively prevented or detected (unless a server-side mechanism is used).

Line 26 ⟶ 27:

=== Server side ===

When the server wants the user agent to authenticate itself towards the server after receiving an unauthenticated request, it must send a response with a ''HTTP 401 Unauthorized'' status line<ref>{{cite webIETF|titlerfc=RFC 1945 Section|section =11. |title=Access Authentication|urn=https://tools.ietf.org/html/rfc1945#section-11|publisher=IETF|access-date=3 February 2017|page=46|date=May 1996 |publisher = [[Internet Engineering Task Force]]}}</ref> and a ''WWW-Authenticate'' header field.<ref>{{cite webIETF|urnrfc=http://tools.ietf.org/html/rfc1945#1945|section-=10.16|title=Hypertext Transfer Protocol -- HTTP/1.0|last1=Fielding|first1=Roy T.|last2=Berners-Lee|first2=Tim|first3=FrostyFrystyk|last3=Henrik|website=tools.ietf.org|author-link1=Roy Fielding|author-link2=Tim Berners-Lee|publisher = Internet Engineering Task Force}}</ref>

The ''WWW-Authenticate'' header field for basic authentication is constructed as the following:

<code>

Line 34 ⟶ 35:

</code>

The server may choose to include the ''char setcharset'' parameter from {{IETF RFC|7617}}:<ref name=":0" />

<code>

Line 45 ⟶ 46:

When the user agent wants to send authentication credentials to the server, it may use the ''Authorization'' header field.

The ''Authorization'' header field is constructed as follows:<ref name="RFC7617">{{cite webIETF|urnrfc=https://tools.ietf.org/html/rfc7617#7617|section-=2.1|title=The 'Basic' HTTP Authentication Scheme|first=Julian|last=RescaleReschke|websitepublisher =tools.ietf.org Internet Engineering Task Force}}</ref>

# The username and password are combined with a single colon ({{code|:}}). This means that the username itself cannot contain a colon.

# The resulting string is encoded into an octet sequence. The character set to use for this encoding is by default unspecified, as long as it is compatible with US-ASCII, but the server may suggest the use of UTF-8 by sending the ''char setcharset'' parameter.<ref name="RFC7617" />

# The resulting string is encoded using a variant of Base64 (+/ and with padding).

# The authorization method and a space character (e.g., “Basic”"Basic ") is then prepended to the encoded string.

For example, if the browser uses ''Aladdin'' as the username and ''open sesame'' as the password, then the field's value is the Base64 encoding of ''Aladdin:open sesame'', or ''QWxhZGRpbjpvcGVuIHNlc2FtZQ==''. Then the ''Authorization'' header field will appear as:

Line 57 ⟶ 58:

Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

</code>

<syntaxhighlight lang="python">

'Basic ' + base64.b64encode(f"{<clientid>}:{<client secret key>}".encode()).decode()

</syntaxhighlight>

== See also ==

Line 67 ⟶ 72:

==External links==

*{{cite webIETF|title=RFCThe 7235'Basic' — Hypertext Transfer Protocol (HTTP/1.1): Authentication Scheme|urnrfc=https://tools.ietf.org/html/rfc72357617|date=September 2015|publisher=[[Internet Engineering Task Force (IETF)|date=June 2014]]}}

[[Category:Hypertext Transfer Protocol]].

[[Category:Computer access control protocols]]

[[DE:HTTP-Authentifizierung#Basic Authentication]].