Send a username and password with Hypertext Transfer Protocol (HTTP) Basic.
HTTP Basic places an encoded username and password in a request header. Hypertext Transfer Protocol Secure (HTTPS) protects that header while it travels across the network.
Why this lesson?
A maintenance script needs to read a protected status endpoint. It uses an account with a username and password.
Learning goal and prerequisites
Read the authentication challenge
The script requests a protected status page over Hypertext Transfer Protocol Secure (HTTPS). The service responds with 401 Unauthorized and a WWW-Authenticate header. This header tells the script which authentication scheme the service accepts.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
Hypertext Transfer Protocol (HTTP) Basic authentication exists because some clients and servers need a very simple, standard way to send a username and password with a request. It is easy to implement and is still used for controlled scripts, small internal services, and some older systems.
The client joins the username and password with a colon, encodes the result with Base64, and places it in the Authorization header. Base64 does not protect the password. It only changes the text representation. For that reason, HTTP Basic must be sent only over Hypertext Transfer Protocol Secure (HTTPS), which uses Transport Layer Security (TLS) to protect the connection.
Even with HTTPS, Basic authentication has an important weakness: the reusable password is presented to the server and may be sent on many requests. If the password is copied from a log, configuration file, or compromised client, it can often be reused until it is changed.
Use Basic authentication only when its simplicity is worth that risk and the environment can protect the credential well. Modern systems often prefer short-lived access tokens or public-key methods because those approaches can reduce password exposure, limit permissions, and make stolen credentials less useful.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.