HTTP Basic Auth: Simple but Insecure Access Control
HTTP Basic Auth is a simple gatekeeper for your API, prompting users for a username and password directly in the browser. It's useful for internal tools, but never use it over unencrypted HTTP as credentials are sent in a trivially decodable format.
Why it exists
HTTP Basic Auth was created to provide a very simple, standardized way to protect a web resource without requiring complex token flows or session management. It's built into the HTTP protocol and supported by all browsers, making it a low-friction option for basic access control.
The mental model
Think of it as a bouncer at a club door who asks for a specific password. If you don't provide one, you're told "unauthorized" and that you need a "Basic" password. When you give the password, the bouncer checks it against their list. The password itself is just written on a piece of paper, not in a secret code, so anyone looking over the bouncer's shoulder can read it.
How it works
When a client requests a protected resource, the server responds with an HTTP 401 "Unauthorized" status and a WWW-Authenticate: Basic header. This triggers the browser to display a native login prompt. The user enters a username and password, which the browser combines as username:password, Base64 encodes, and sends back in the Authorization header on subsequent requests. The server then decodes this string and validates the credentials.
When to use it
Use it for simple, low-stakes applications where you need a quick layer of protection. It's a good fit for internal admin dashboards, staging environments, or simple machine-to-machine APIs where you control both the client and server and can ensure the connection is over HTTPS.
When not to use it
Never use HTTP Basic Auth over an unencrypted HTTP connection. The Base64 encoding is trivial to reverse, exposing credentials to anyone intercepting the traffic. It's also unsuitable for applications requiring fine-grained permissions, "remember me" functionality, or protection against credential stuffing. For most production applications, token-based authentication like OAuth2 is a much safer choice.
One canonical example
A common footgun is vulnerability to timing attacks. An attacker can measure the server's response time to guess if a username is valid, even with an invalid password. A naive string comparison like if submitted_pass == correct_pass: might return faster if the first character doesn't match. To prevent this, use a constant-time comparison function, such as secrets.compare_digest() in Python, which takes the same amount of time to execute regardless of where the mismatch occurs.
Interview question
What is the primary security concern when using HTTP Basic Auth over an unencrypted HTTP connection?
- a.The credentials are encrypted with a weak algorithm, making them easy to crack.
- b.The Base64 encoded credentials can be trivially decoded, exposing them to interception.Correct
- c.The username and password are sent without any form of obfuscation, making them directly readable.
- d.It is highly susceptible to credential stuffing attacks due to lack of rate limiting.
Why? this is the answer
The card states that Base64 encoding is 'trivial to reverse,' meaning anyone intercepting the traffic can easily decode the credentials. It clarifies that Base64 is an encoding, not an encryption, making option A incorrect.
Just read this? Test yourself on what you have been reading.
Read the original → fastapi.tiangolo.com
You just looked this up. Could you explain it out loud?
That is the part interviews actually test. Tezvyn takes questions like this one and gives you what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on http — each one lists the topics its interview covers.
See open roles