9. HTTP Authentication
HTTP supports the use of several authentication mechanisms to control access to pages and other resources. These mechanisms are all based around the use of the 401 status code, the www-authenticate response header and the authorization request header.
The most widely used HTTP authentication mechanisms are:
| Basic | The client sends the user name and password as unencrypted base64 encoded text. It must only be used with HTTPS, as the password can be easily captured and reused over HTTP. |
| Bearer | The client sends an access token, typically obtained by signing in with an identity provider using OAuth 2.0 or OpenID Connect. This is the usual way of authenticating calls to web APIs. Anyone who obtains the token can use it until it expires, so it must also only be sent over HTTPS. |
| Negotiate | Used on corporate networks to automatically sign in with the user's Windows account, using Kerberos or the older NTLM protocol. The user's password is never sent to the server. |
Other mechanisms such as Digest are also defined, but are now rarely used.
Most web sites do not use HTTP authentication to sign in users. Instead, the user enters their details into an HTML form, which is submitted with a POST (see 6. Methods). If the details are valid, the server returns a session cookie (see 4. Cookies) that identifies the user in later requests. Passkeys, which use public key cryptography in place of passwords, are also increasingly used to sign in to web sites.
In this section, we will look at the Basic authentication mechanism, which is defined in RFC 7617. The general HTTP authentication framework is described in RFC 9110.
9.1 Basic Authentication
If an HTTP server receives an anonymous request for a protected resource it can request Basic authentication by rejecting the request with a 401 (Unauthorized) status code and setting the www-authenticate response header. For example, this is the response from www.httpwatch.com when you first click the button in Example 9 below:
:status: 401
cache-control: no-cache, no-store
content-type: text/html
date: Tue, 13 Oct 2026 11:03:19 GMT
server: Microsoft-IIS/10.0
www-authenticate: Basic realm="Login with a user name of httpwatch and a different password each time"
x-powered-by: ASP.NETThe word Basic in the www-authenticate header selects the authentication mechanism that the HTTP client must use to access the resource. The realm string can be set to any value to identify the protected area and may be used by HTTP clients to manage passwords.
Web browsers display a sign in dialog when this response is received, allowing the user to enter a username and password. This information is then used to retry the request with an authorization request header:
:authority: www.httpwatch.com
:method: GET
:path: /httpgallery/authentication/authenticatedimage/?0.5394187651390532
:scheme: https
authorization: Basic aHR0cHdhdGNoOmZvbw==(Other request headers, such as accept and user-agent, have been left out to keep the example short.)
The authorization header specifies the authentication mechanism (in this case Basic) followed by the username and password. Although the string aHR0cHdhdGNoOmZvbw== may look encrypted, it is simply a base64 encoded version of <username>:<password>. In this example, the user name httpwatch and password foo were entered, giving the un-encoded string "httpwatch:foo", which would be readily available to anyone who could intercept an unencrypted HTTP request.
The browser remembers the credentials and automatically sends them with later requests to the same site until it is closed.
Example 9
Clicking the Display Image button will attempt to access an image file that uses HTTP Basic Authentication. You will need to enter httpwatch as the username and a different password every time you access the image:
Authenticated Image:
Using HttpWatch with Example 9
To view the use of HTTP authentication on this page:
- Open HttpWatch by pressing Ctrl+Shift+H, clicking the HttpWatch icon on the browser toolbar, or right-clicking the page and selecting HttpWatch
- Click on Record to start logging requests in HttpWatch
- Click on the Display Image button above
- A 401 response is received and the sign in dialog is displayed.
- If you enter a username of httpwatch and some unique text as the password, the request will be successfully processed with a 200 response.
- Select the Headers tab to view the use of the www-authenticate and Authorization headers