HTTP Basic Authentication is one of the oldest and simplest ways to password-protect a resource: the browser prompts for a username and password, and they're sent to the server with every request. That simplicity is also its main weakness.
How the Authorization header is built
The username and password are joined with a colon (username:password), then the whole string is Base64-encoded and placed in the Authorization: Basic <encoded_string> header. The browser automatically re-sends this header on every subsequent request after the first successful login.
Why Base64 isn't security
Base64 is an encoding scheme, not encryption: anyone can decode the string back to username:password in seconds, no key required. If the request is intercepted — say, over an unsecured public Wi-Fi network — the credentials are exposed instantly.
Non-ASCII credentials and RFC 7617
The original 1999 Basic Auth spec (RFC 2617) never defined a character encoding for the username and password, which was a real problem once accented or non-Latin characters showed up in credentials. RFC 7617, published in 2015, formally added an optional charset="UTF-8" parameter so clients and servers agree on how to interpret bytes before decoding. It's a good reminder that Base64 encodes bytes, not characters — a password with even a single non-ASCII character (say, a curly quote or an em dash) will encode to more bytes than its character count suggests once UTF-8 expands it.
What this is useful for
- Quickly password-protect a staging server or internal tool during development.
- Build a correct Authorization header for manually testing an API with curl or Postman.
- Understand why Basic Auth over plain HTTP is treated as a serious security issue.
Basic Auth has no built-in logout
The browser caches the credentials and automatically attaches the Authorization header to every following request to the same origin until the tab is closed — the protocol simply has no standard "log out" button. To force a user out, servers resort to tricks: deliberately returning 401 with a different realm value, or relying on the user to close every browser tab themselves.