Question 1

What is HTTP Basic Authentication?

Accepted Answer

HTTP Basic Authentication (RFC 7617) is a simple authentication scheme built into HTTP. The client sends credentials as a Base64-encoded string of username:password in the Authorization header: Authorization: Basic dXNlcjpwYXNz. The server decodes the Base64 and validates the credentials. Basic Auth is stateless — credentials are sent with every request. It is simple to implement but must always be used over HTTPS, because Base64 is encoding (not encryption) and can be trivially decoded.

Question 2

Is HTTP Basic Authentication secure?

Accepted Answer

Basic Auth is secure only when used over HTTPS. Without TLS, credentials are transmitted in clear text (Base64 is not encryption). With HTTPS: credentials are encrypted in transit, but they are still sent with every request — if a token/session is compromised, it cannot be easily revoked without a password change. For modern applications, prefer API keys, OAuth 2.0 bearer tokens, or JWT. Basic Auth is appropriate for simple internal tools, CI/CD pipelines, and API testing.

Question 3

How do I use Basic Auth with cURL?

Accepted Answer

Use the -u flag: curl -u username:password https://api.example.com/data. cURL Base64-encodes the credentials and adds the Authorization header automatically. You can also set the header manually: curl -H 'Authorization: Basic dXNlcjpwYXNz' https://api.example.com/data. In Postman, select 'Basic Auth' in the Authorization tab and enter username/password — Postman generates the header for you. Never hardcode credentials in scripts; use environment variables.

Question 4

How do I decode a Basic Auth header to see the credentials?

Accepted Answer

The value after 'Basic ' is Base64-encoded. Decode it to get username:password: atob('dXNlcjpwYXNz') in JavaScript returns 'user:pass'. Command line: echo 'dXNlcjpwYXNz' | base64 -d. The separator is the first colon — usernames cannot contain colons but passwords can. If a server logs Authorization headers, credentials are exposed in logs. Always configure your logging to redact or omit Authorization headers in production.

các công cụ miễn phí dành cho lập trình viên web

Trình tạo Basic Auth

Thông tin đăng nhập

Mã hóa Base64

Header Authorization

Trình tạo Basic Auth hoạt động như thế nào

Công cụ làm gì

Các trường hợp sử dụng phổ biến cho lập trình viên

Định dạng dữ liệu, kiểu hoặc biến thể

Các lỗi thường gặp và trường hợp biên

Khi nào nên dùng công cụ này thay vì viết mã