Verwenden HTTP Basic Authentication
Basic Auth sends Anmeldedaten als Base64-encoded username:Passwort in der Authorization Header. Lernen der formatieren, Sicherheit requirements, und alternatives.
- 1
Basic Auth sends "Authorization: Basic <base64(username:password)>" in the HTTP header. The credentials are encoded (not encrypted) — Base64 is reversible. Always use Basic Auth over HTTPS; over HTTP, credentials are exposed. The browser shows a native login prompt when a server returns 401 with WWW-Authenticate: Basic.
- 2 Base64-Kodierer →
Codieren "username:password" as Base64 to create the Authorization header value. For example, "admin:secret" → "YWRtaW46c2VjcmV0". The header is: Authorization: Basic YWRtaW46c2VjcmV0.
- 3 Base64-Dekodierer →
Dekodieren a Basic Auth header to extract the credentials. Remove "Basic " prefix, Base64-decode the rest, split on ":". This is what servers do to verify credentials. Never log the Authorization header — it contains reversible credentials.
- 4 base64-decode
Use the Basic Auth decode workflow to extract and inspect credentials from an Authorization header.
Häufige Fragen
- Ist Basic Auth sicher?
- Only over HTTPS. The credentials are Base64-encoded (reversible), not encrypted. Over HTTP, anyone on the network can read them. Even over HTTPS, Basic Auth has drawbacks: credentials are sent on every request, logout is unreliable (browser caches), and there is no token expiration.
- Basic Auth vs Bearer token?
- Bearer tokens are preferred: they expire (limiting compromise window), can be scoped (limited permissions), and don't expose the user's password. Use Basic Auth for simple APIs, internal tools, or API keys. Use Bearer tokens (JWT, OAuth) for production applications.