Usar HTTP Basic Authentication
Basic Auth sends credenciales como Base64-encoded username:contraseña en el Authorization encabezado. Aprender el formatear, seguridad requirements, y alternatives.
- 1
Basic Auth sends "Authorization: Basic <base64(username:password)>" in the HTTP header. The credentials are encoded (not encrypted) — Base64 is reversible. Always use Basic Auth over HTTPS; over HTTP, credentials are exposed. The browser shows a native login prompt when a server returns 401 with WWW-Authenticate: Basic.
- 2 Codificador Base64 →
Codificar "username:password" as Base64 to create the Authorization header value. For example, "admin:secret" → "YWRtaW46c2VjcmV0". The header is: Authorization: Basic YWRtaW46c2VjcmV0.
- 3 Decodificador Base64 →
Decodificar a Basic Auth header to extract the credentials. Remove "Basic " prefix, Base64-decode the rest, split on ":". This is what servers do to verify credentials. Never log the Authorization header — it contains reversible credentials.
- 4 base64-decode
Use the Basic Auth decode workflow to extract and inspect credentials from an Authorization header.
Preguntas frecuentes
- ¿Es Basic Auth seguro?
- Only over HTTPS. The credentials are Base64-encoded (reversible), not encrypted. Over HTTP, anyone on the network can read them. Even over HTTPS, Basic Auth has drawbacks: credentials are sent on every request, logout is unreliable (browser caches), and there is no token expiration.
- Basic Auth vs Bearer token?
- Bearer tokens are preferred: they expire (limiting compromise window), can be scoped (limited permissions), and don't expose the user's password. Use Basic Auth for simple APIs, internal tools, or API keys. Use Bearer tokens (JWT, OAuth) for production applications.