HTTP provides a general framework for access control and authentication. The most common HTTP authentication is based on the "Basic" schema. This page shows an introduction to the HTTP framework for authentication and shows how to restrict access to your server using the HTTP "Basic" schema. The general HTTP authentication framework defines the HTTP authentication framework which can be used by a server to a client request and by a client to provide authentication information. The challenge and response flow works like this: The server responds to a client with a (Unauthorized) response status and provides information on how to authorize with a response header containing at least one challenge. RFC 7235 challenge 401 WWW-Authenticate A client that wants to authenticate itself with a server can then do so by including an request header field with the credentials. Usually a client will present a password prompt to the user and will then issue the request including the correct header. Authorization Authorization In the case of a "Basic" authentication like shown in the figure, the exchange happen over an HTTPS (TLS) connection to be secure. must Proxy authentication The same challenge and response mechanism can be used for . In this case, it is an intermediate proxy that requires authentication. As both resource authentication and proxy authentication can coexist, a different set of headers and status codes is needed. In the case of proxies, the challenging status code is (Proxy Authentication Required), the response header contains at least one challenge applicable to the proxy, and the request header is used for providing the credentials to the proxy server. proxy authentication 407 Proxy-Authenticate Proxy-Authorization Access forbidden If a (proxy) server receives valid credentials that are not adequate to gain access for a given resource, the server should respond with the status code. Unlike Unauthorized or , authentication is impossible for this user. 403 Forbidden 401 407 Proxy Authentication Required A potential security hole that has recently been fixed by browsers is authentication of cross-site images. From onwards, image resources loaded from different origins to the current document are no longer able to trigger HTTP authentication dialogs ( ), preventing user credentials being stolen if attackers were able to embed an arbitrary image into a third-party page. Authentication of cross-origin images Firefox 59 bug 1423146 Browsers use utf-8 encoding for usernames and passwords. Firefox used to use  ISO-8859-1, but changed over to utf-8 for parity with other browsers, and to avoid potential problems as described in . Character encoding of HTTP authentication bug 1419658 The and response headers define the authentication method that should be used to gain access to a resource. They need to specify which authentication scheme is used, so that the client that wishes to authorize knows how to provide the credentials. WWW-Authenticate and Proxy-Authenticate headers WWW-Authenticate Proxy-Authenticate The syntax for these headers is the following: WWW-Authenticate: <realm>
Proxy-Authenticate: <type> realm=<realm> realm= < > type Here, is the authentication scheme ("Basic" is the most common scheme and ). The is used to describe the protected area or to indicate the scope of protection. This could be a message like "Access to the staging site" or similar, so that the user knows to which space they are trying to get access to. <type> introduced below realm Authorization and Proxy-Authorization headers The and request headers contain the credentials to authenticate a user agent with a (proxy) server. Here, the type is needed again followed by the credentials, which can be encoded or encrypted depending on which authentication scheme is used. Authorization Proxy-Authorization Authorization: <credentials>
Proxy-Authorization: <type> <credentials> < > type The general HTTP authentication framework is used by several authentication schemes. Schemes can differ in security strength and in their availability in client or server software. Authentication schemes The most common authentication scheme is the "Basic" authentication scheme which is introduced in more details below. IANA maintains a , but there are other schemes offered by host services, such as Amazon AWS. Common authentication schemes include: list of authentication schemes (see , base64-encoded credentials. See below for more information.), Basic RFC 7617 (see , bearer tokens to access OAuth 2.0-protected resources), Bearer RFC 6750 (see , only md5 hashing is supported in Firefox, see for SHA encryption support), Digest RFC 7616 bug 472823 (see , Section 3, TTP rigin- ound uthentication, digital-signature-based), HOBA RFC 7486 H O B A (see ), Mutual RFC 8120 (see ). AWS4-HMAC-SHA256 AWS docs Basic authentication scheme The "Basic" HTTP authentication scheme is defined in , which transmits credentials as user ID/password pairs, encoded using base64. RFC 7617 As the user ID and password are passed over the network as clear text (it is base64 encoded, but base64 is a reversible encoding), the basic authentication scheme is not secure. HTTPS / TLS should be used in conjunction with basic authentication. Without these additional security enhancements, basic authentication should not be used to protect sensitive or valuable information. Security of basic authentication To password-protect a directory on an Apache server, you will need a and a file. Restricting access with Apache and basic authentication .htaccess .htpasswd The file typically looks like this: .htaccess AuthType Basic
AuthName AuthUserFile /path/to/.htpasswd
Require valid-user "Access to the staging site" The file references a file in which each line consists of a username and a password separated by a colon (":"). You cannot see the actual passwords as they are (md5 in this case). Note that you can name your file differently if you like, but keep in mind this file shouldn't be accessible to anyone. (Apache is usually configured to prevent access to files). .htaccess .htpasswd encrypted .htpasswd .ht* aladdin:$apr1$ZjTqBB3f$IF9gdYAGlMrs2fuINjHsz.
user2:$apr1$O04r.y2H$/vEkesPhVInBByJUkXitA/ For nginx, you will need to specify a location that you are going to protect and the directive that provides the name to the password-protected area. The directive then points to a file containing the encrypted user credentials, just like in the Apache example above. Restricting access with nginx and basic authentication auth_basic auth_basic_user_file .htpasswd location /status {                                       
    auth_basic ;
    auth_basic_user_file /etc/apache2/.htpasswd;
} "Access to the staging site" Many clients also let you avoid the login prompt by using an encoded URL containing the username and the password like this: Access using credentials in the URL https: //username:password@www.example.com/ . In Chrome, the @ part in URLs is even for security reasons. In Firefox, it is checked if the site actually requires authentication and if not, Firefox will warn the user with a prompt "You are about to log in to the site “www.example.com” with the username “username”, but the website does not require authentication. This may be an attempt to trick you." The use of these URLs is deprecated username:password stripped out See also WWW-Authenticate Authorization Proxy-Authorization Proxy-Authenticate 401 403 407 Credits Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication Published under licence Open CC Attribution ShareAlike 3.0

Too Long; Didn't Read

Making security fun one episode at a time

How Does HTTP Authentication Work

Too Long; Didn't Read

Mozilla Contributors

About Author

TOPICS

THIS ARTICLE WAS FEATURED IN...

How Does HTTP Authentication Work

Too Long; Didn't Read

Mozilla Contributors

About Author

TOPICS

THIS ARTICLE WAS FEATURED IN...

RELATED STORIES