What is it?

Basic Authentication is the most common HTTP protocol authentication system. It is included in the header of the HTTP request in this way:

Authorization: Basic {credenciais em base 64 no formato usuário:senha}

Please note that Base 64 is a coding and non-encryption scheme. Therefore, you MUST use it only with an HTTPS (TLS) connection. The use of Base 64 is due to the MIME standard .

Workflow

The authentication scheme works like this: the server responds to the HTTP client code 401 Unauthorized) and with a WWW-Authenticate header, which gives information on how to authenticate. The client sends the request with the header authentication, shown above. If the credentials are correct, you will receive a response other than 403 (Forbidden) .

Security

BasicAuthonHTTPS(TLS)isgood,butnot100%secure.Itsusewilldependonthelevelofriskofthedatabeingtransited.Noticethatwitheachrequestyouwillbesendingthecredentials.Authenticationcanbepermanentlystoredinthebrowserifrequiredbytheuser(verydifficulttodowhenitcomestoRESTfulAPIs).

Thereareseveralstepsyoucantaketoincreasethesecurityofyourservice.Iwillnotstretch,buthighlightonepoint:generateAPIkeysthatarenotbrokeneasily.Takealook in the UUIDs .

When to use?

Only you can analyze this. What is the confidentiality level of data in transit via HTTP? If it's high, it might be worth investing in another authentication scheme.

A great advantage of Basic Auth is simplicity. Both for the client and for the server. This will accelerate development for both sides.

Using more modern authentication schemes, such as OAuth and OAuth2 bring their advantages, but you have to look at the real need.

I'll leave some links that can help in choosing:

• APIUX: "How OAuth 2 trumps Basic Authentication?"
• Engineering Software: "OAuth2 ROPC vs. Basic Auth for public REST APIs"
• Security: "Is HTTPS and Basic Authentication secure enough for banking web services (RESTful)? "
• Randall Degges: "Why I Love Basic Auth?"

Basic authentication, or basic authentication is a simple authentication scheme built into the HTTP protocol.

The client sends HTTP requests with the Authorization authorization header containing the word Basic followed by a space and a plain text username and password separated by two points (: ) using base64.

For example, to authorize the user test with password @55w0rd , the client would send in the request:

• Authorization: Basic dGVzdDpANTV3MHJk

Note: Because base64 is easily decoded, basic authentication should only be used in conjunction with other security mechanisms, such as HTTPS / TLS.

Regarding the usage scenarios, starting from a more pragmatic point of view, you should use Basic Authentication in small applications where you do not need to have a security control as effective as it is much more simple to implement, but the opposite is true for using OAuth and OAuth2 .