Http - Security- Basic Authentication

There are two authetication mechanism that are built in Http protocol itself

• Basic Authentication
• Digest Authentication

In this post I will try to explain ‘Basic Authentication’.

In ‘Basic Authentication’ you protect portion of your webserver through basic authentication. For this ,in web.xml you provide a URL pattern for which basic authentication applies. Now when a request comes for that particular URL, the server sends the response back. Server sends a challenge back to the browser in the following form –

Client request (no authentication):

GET /private/index.html HTTP/1.0


Server response:

HTTP/1.0 401
Authorization Required
Server: HTTPd/1.0
Date: Sat, 27 Nov 2004 10:18:15
GMT
WWW-Authenticate: Basic realm="Corp Login"
Content-Type: text/html
Content-Length: 311

plus some more html...


Server tells the browser that the resource being asked is protected.
Seeing this the browser pop us a window asking for username and password.

Now the user provides the username and password in the popup window.
Browser uses base64 encoding to encode the provided user name and password and sends that back to server.


GET /private/index.html HTTP/1.0 Host:localhost
Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==


The server will decode the user name and password and will compare this with the stored values. The server will retrieve the username from the decoded string and then it can compare thecorresponding password. If username and password is correct, then the resource will be presented to the client.

This one is simple, but there is one potential security hole. The username and password is travelling over the network. Someone can sniff the network and take out the bytes and since it is a known Base64 encoding. He can decrypt it and then can use the same credentials. Even if the person doesn’t decode the password, just by sniffing the network he can have the string which is being sent in Authorization header. Now he can simply send this header with every request and thus can fool the server in believing that it is the correct user who is sending this information.

For More security we need something else..digest authentication....

There are couple of questions though

• so the browser caches the encoded username:password string? If we access other url which is protected by the same realm we will not be asked for the password..right?
• But if we access the url which is protected by other url, the browser will prompt for the password. So browser cached this string(username:password) for every different realm?
• And these realm will not be shared accress the websites
• So this caching of information happens through cookies?