HTTP provides a general framework for access control and authentication. The most common HTTP authentication scheme is the "Basic" authentication. This page introduces the general HTTP auth framework and shows how to restrict access to your server with HTTP Basic authentication.
The general HTTP authentication framework
RFC 7235
defines the HTTP authentication framework which can be used by a server to challenge
a client request and by a client to provide authentication information. The challenge and response flow works like this: The server responds to a client with a
401
(Unauthorized) response status and provides information on how to authorize with a WWW-Authenticate
response header containing at least one challenge. A client that wants to authenticate itself with a server can then do so by including an Authorization
request header field with the credentials. Usually a client will present a password prompt to the user and will then issue the request including the correct Authorization
header.
In the case of a "Basic" authentication like shown in the figure, the exchange
must
happen over an HTTPS (TLS) connection to be secure.
Proxy authentication
The same challenge and response mechanism can be used for
proxy authentication. In this case, it is an intermediate proxy that requires authentication. As both resource authentication and proxy authentication can coexist, a different set of headers and status codes is needed. In the case of proxies, the challenging status code is
407
(Proxy Authentication Required), the Proxy-Authenticate
response header contains at least one challenge applicable to the proxy, and the Proxy-Authorization
request header is used for providing the credentials to the proxy server.Access forbidden
If a (proxy) server receives valid credentials that are not adequate to gain access for a given resource, the server should respond with the
403
Forbidden
status code. Unlike 401
Unauthorized
or 407
Proxy Authentication Required, authentication is impossible for this user.WWW-Authenticate
and Proxy-Authenticate
headers
The
WWW-Authenticate
and Proxy-Authenticate
response headers define the authentication method that should be used to gain access to a resource. They need to specify which authentication scheme is used, so that the client that wishes to authorize knows how to provide the credentials. The syntax for these headers is the following:WWW-Authenticate: <type> realm=<realm> Proxy-Authenticate: <type> realm=<realm>
Here,
<type>
is the authentication scheme ("Basic" is the most common scheme and introduced below). The
realm
is used to describe the protected area or to indicate the scope of protection. This could be a message like "Access to the staging site" or similar, so that the user knows to which space they are trying to get access to.Authorization
and Proxy-Authorization
headers
The
Authorization
and Proxy-Authorization
request headers contain the credentials to authenticate a user agent with a (proxy) server. Here, the type is needed again followed by the credentials, which can be encoded or encrypted depending on which authentication scheme is used.Authorization: <type> <credentials> Proxy-Authorization: <type> <credentials>
Authentication schemes
The general HTTP authentication framework is used by several authentication schemes. Schemes can differ in security strength and in their availability in client or server software.
The most common authentication scheme is the "Basic" authentication scheme which is introduced in more details below. IANA maintains a
list of authentication schemes, but there are other schemes offered by host services, such as Amazon AWS. Common authentication schemes include:
- Basic (see RFC 7617, base64-encoded credentials. See below for more information.),
- Bearer (see RFC 6750, bearer tokens to access OAuth 2.0-protected resources),
- Digest (see RFC 7616, only md5 hashing is supported in Firefox, see bug 472823 for SHA encryption support),
- HOBA (see RFC 7486 (draft), HTTP Origin-Bound Authentication, digital-signature-based),
- Mutual (see draft-ietf-httpauth-mutual),
-
AWS4-HMAC-SHA256 (see AWS docs).
Basic authentication scheme
The "Basic" HTTP authentication scheme is defined in
RFC 7617, which transmits credentials as user ID/password pairs, encoded using base64.
Security of basic authentication
As the user ID and password are passed over the network as clear text (it is base64 encoded, but base64 is a reversible encoding), the basic authentication scheme is not secure. HTTPS / TLS should be used in conjunction with basic authentication. Without these additional security enhancements, basic authentication should not be used to protect sensitive or valuable information.
Restricting access with Apache and basic authentication
To password-protect a directory on an Apache server, you will need a
.htaccess
and a .htpasswd
file.The
.htaccess
file typically looks like this:AuthType Basic
AuthName "Access to the staging site"
AuthUserFile /path/to/.htpasswd
Require valid-userThe
.htaccess
file references a .htpasswd
file in which each line contains of a username and a password separated by a colon (":"). You can not see the actual passwords as they are encrypted
(md5 in this case). Note that you can name your .htpasswd
file differently if you like, but keep in mind this file shouldn't be accessible to anyone. (Apache is usually configured to prevent access to .ht*
files).aladdin:$apr1$ZjTqBB3f$IF9gdYAGlMrs2fuINjHsz.
user2:$apr1$O04r.y2H$/vEkesPhVInBByJUkXitA/Restricting access with nginx and basic authentication
For nginx, you will need to specify a location that you are going to protect and the
auth_basic
directive that provides the name to the password-protected area. The auth_basic_user_file
directive then points to a .htpasswd file containing the encrypted user credentials, just like in the Apache example above.location /status {
auth_basic "Access to the staging site";
auth_basic_user_file /etc/apache2/.htpasswd;
}Access using credentials in the URL
Many clients also let you avoid the login prompt by using an encoded URL containing the username and the password like this:
https://username:password@www.example.com/The use of these URLs is deprecated. In Chrome, the
username:password@
part in URLs is even stripped out
for security reasons. In Firefox, it is checked if the site actually requires authentication and if not, Firefox will warn the user with a prompt "You are about to log in to the site “www.example.com” with the username “username”, but the website does not require authentication. This may be an attempt to trick you.".