Basic Authentication

Basic authentication is a simple authentication scheme built into the HTTP protocol. The client sends HTTP requests with the Authorization header that contains the word Basic word followed by a space and a base64-encoded string username:password. For example, to authorize as demo / p@55w0rd the client would send^[1]:

Authorization: Basic ZGVtbzpwQDU1dzByZA==

It is specified in RFC 7617 from 2015, which obsoletes RFC 2617 from 1999.

Note: Because base64 is easily decoded, Basic authentication should only be used together with other security mechanisms such as HTTPS/SSL.

Basic authentication is often used in scenarios where simplicity is paramount, such as in internal applications, prototypes, or scripts where the overhead of more complex authentication mechanisms is not justified. It is also commonly used in conjunction with other authentication methods to provide an additional layer of security.

However, there are significant dangers associated with using Basic authentication. Since the credentials are only base64-encoded, they can be easily decoded if intercepted. This makes Basic authentication highly vulnerable to man-in-the-middle attacks if not used over a secure connection (HTTPS). Additionally, because the credentials are sent with every request, they are more susceptible to being compromised. Developers should be cautious and consider more secure alternatives like OAuth or token-based authentication for production environments.

When the server receives a request with the Authorization header, it decodes the base64-encoded string to retrieve the username and password. The server then verifies these credentials against its user database. If the credentials are valid, the server processes the request and returns the appropriate response. If the credentials are invalid, the server responds with a 401 Unauthorized status code, prompting the client to provide valid credentials. This process is stateless, meaning that the server does not need to store any session information about the client between requests.

Source:
[1] wagger.io/docs/specification/authentication/basic-authentication/