Utiliser HTTP Basic Authentication
Basic Auth sends identifiants comme Base64-encoded username:mot de passe en le Authorization en-tête. Apprendre le formater, sécurité requirements, et alternatives.
- 1
Basic Auth sends "Authorization: Basic <base64(username:password)>" in the HTTP header. The credentials are encoded (not encrypted) — Base64 is reversible. Always use Basic Auth over HTTPS; over HTTP, credentials are exposed. The browser shows a native login prompt when a server returns 401 with WWW-Authenticate: Basic.
- 2 Encodeur Base64 →
Coder "username:password" as Base64 to create the Authorization header value. For example, "admin:secret" → "YWRtaW46c2VjcmV0". The header is: Authorization: Basic YWRtaW46c2VjcmV0.
- 3 Décodeur Base64 →
Décoder a Basic Auth header to extract the credentials. Remove "Basic " prefix, Base64-decode the rest, split on ":". This is what servers do to verify credentials. Never log the Authorization header — it contains reversible credentials.
- 4 base64-decode
Use the Basic Auth decode workflow to extract and inspect credentials from an Authorization header.
Questions fréquentes
- Basic Auth est-il sécurisé ?
- Only over HTTPS. The credentials are Base64-encoded (reversible), not encrypted. Over HTTP, anyone on the network can read them. Even over HTTPS, Basic Auth has drawbacks: credentials are sent on every request, logout is unreliable (browser caches), and there is no token expiration.
- Basic Auth vs Bearer token?
- Bearer tokens are preferred: they expire (limiting compromise window), can be scoped (limited permissions), and don't expose the user's password. Use Basic Auth for simple APIs, internal tools, or API keys. Use Bearer tokens (JWT, OAuth) for production applications.