Authentication

Question 1

HTTP Basic Auth

Answer 1

• Username/password are encoded (e.g. base64) but not encrypted. They are not hidden by HTTP.
• Easiest to Implement
• Stateless

Question 1

What request headers are required for HTTP Basic Auth?

Answer 1

Authorization: Basic

Question 2

What response headers are required for HTTP Basic Auth?

Answer 2

401 Unauthorized and WWW-Authenticate: Basic

Question 3

What files are considered authenticated when using HTTP Basic Auth?

Answer 3

If we authenticate at: dir/subdir/index.html, all files and subdirectories at or below will be considered authenticated (e.g. dir/subdir/1, dir/subdir/post.html)

Question 4

HTTP Digest Auth

Answer 4

• Uses cryptographic hashes (SHA-256 hash), designed to hide username and password
• Another encryption layer (TLS) below HTTP (HTTPS) is required for security
• Doesn’t prevent tampering with content, headers, paths, etc.