Use HTTP 基础 Authentication
基础 Auth sends credentials as Base64-encoded username:password 在 Authorization 头. Learn 格式化, 安全 requirements, 和 alternatives.
- 1
基础 Auth sends "Authorization: 基础 <base64(username:password)>" 在 HTTP 头. credentials 是 encoded (不 encrypted) — Base64 是 reversible. 总是 use 基础 Auth 遍历 HTTPS; 遍历 HTTP, credentials 是 exposed. browser shows native login prompt 当服务器 returns 401 具有 WWW-Authenticate: 基础.
- 2 Base64 编码器 →
编码 "username:password" as Base64 to create the Authorization header value. For example, "admin:secret" → "YWRtaW46c2VjcmV0". The header is: Authorization: Basic YWRtaW46c2VjcmV0.
- 3 Base64 解码器 →
解码 a Basic Auth header to extract the credentials. Remove "Basic " prefix, Base64-decode the rest, split on ":". This is what servers do to verify credentials. Never log the Authorization header — it contains reversible credentials.
- 4
常见问题
- Basic Auth 安全吗?
- Only 遍历 HTTPS. credentials 是 Base64-encoded (reversible), 不 encrypted. 遍历 HTTP, 任何人开 网络能够读取它们. Even 遍历 HTTPS, 基础 Auth 有 drawbacks: credentials 是 sent 开每个请求, logout 是 unreliable (browser caches), 和那里是 否令牌 expiration.
- 基础 Auth vs Bearer 令牌?
- Bearer tokens 是 preferred: 它们 expire (limiting compromise window), 能够是 scoped (limited permissions), 和 don't expose 用户's password. Use 基础 Auth 为简单 APIs, 内部 tools, 或 API 关键. Use Bearer tokens (JWT, OAuth) 为 production applications.