The server sends back a header stating it requires authentication for a
given realm. The user provides the username and password, which the
browser concatenates (username + ":" + password), and base64 encodes.
This encoded string is then sent using a "Authorization"-header on each
request from the browser.
Because the credentials are only encoded, not encrypted, this is highly
insecure unless it is sent over https.
http://security.stackexchange.com/questions/755/how-does-basic-http-auth-work
No comments:
Post a Comment