Basic Authentication

HTTP Basic authentication sends a user identifier and password encoded in each request credential.

Use Basic only over TLS and preferably behind a stronger session or gateway design. The base64 value is encoding, not encryption; enforce rate limits, credential rotation, and safe challenge handling.

httpauthsecurityauthentication

Reference (http)

Authorization: Basic <base64(username:password)>
WWW-Authenticate: Basic realm="api", charset="UTF-8"

Common mistakes

Calling base64 encryption, accepting credentials over cleartext HTTP, or forwarding origin credentials to a proxy.

Authorization Header HTTP Authentication Flow OAuth, OIDC, and Bearer Token Handling

Sources

MDN HTTP Reference
OWASP HTTP Headers Cheat Sheet
MDN HTTP Authentication
RFC 7617: The Basic HTTP Authentication Scheme
OWASP Authentication Cheat Sheet