understanding basic authentication with a 401

Question

I'm a little confused about Basic authentication in regards to web browsers. I had thought that the web browser would only send an Authorization header after having received an HTTP 401 status in the previous response. However, it appears that Chrome sends the Authorization header with every request thereafter. It has the data that I entered once upon a time in response to a 401 from my website and sends it with every message (according to the developer tools that ship with Chrome and my webserver). Is that expected behavior? Is there some header I should use with my 401 to infer that the Authorization stuff should not be cached? I'm using WWW-Authenticate header currently.

score 8 · Accepted Answer · answered Dec 24 '12 at 19:22

This is the expected behavior of the browser as defined in RFC 2617 (Section 2):

A client SHOULD assume that all paths at or deeper than the depth of
the last symbolic element in the path field of the Request-URI also
are within the protection space specified by the Basic realm value of
the current challenge. A client MAY preemptively send the
corresponding Authorization header with requests for resources in
that space without receipt of another challenge from the server.
Similarly, when a client sends a request to a proxy, it may reuse a
userid and password in the Proxy-Authorization header field without
receiving another challenge from the proxy server. See section 4 for
security considerations associated with Basic authentication.

to my knowledge, Basic HTTP authentication has no ability to perform a logout / re-authentication. This along with the lack of security of HTTP Basic authentication is why most websites now use forms and cookies for auth solutions.

You are correct. 'Logout' is fairly meaningless within the scope of Basic Auth because the security tokens are sent *in every request*. In essence, each HTTP request is individually authenticated. You can force a browser to stop authenticating, eg see http://stackoverflow.com/questions/5957822/how-to-clear-basic-authentication-details-in-chrome. — Andrew Alcock, Dec 31 '12 at 07:04

score 1 · Answer 2 · edited Oct 07 '21 at 06:15

From RFC 2617:

If a prior request has been authorized, the same credentials MAY be reused for all other requests within that protection space for a period of time determined by the authentication scheme, parameters, and/or user preference.

From my experience it is quite common to see browsers automatically sending the Basic credentials for subsequent requests. It prevents having to do an extra round trip for additional resources.

understanding basic authentication with a 401

2 Answers2