Skip to content

Class 11 Authentication

Jump to bottom
Erin Trainor edited this page Apr 2, 2019 · 2 revisions

Authentication Readings Notes

Resource - Basic Access Authentication

Basic Access Authentication

A method for an HTTP user agent (e.g. a web browser) to provide a user name and password when making a request. In basic HTTP authentication, a request contains a header field of the form Authorization: Basic , where credentials is the base64 encoding of id and password joined by a colon.

HTTP Basic authentication (BA) implementation is the simplest technique for enforcing access controls to web resources because it does not require cookies, session identifiers, or login pages; rather, HTTP Basic authentication uses standard fields in the HTTP header.

Security

The BA mechanism provides no confidentiality protection for the transmitted credentials. They are merely encoded with Base64 in transit, but not encrypted or hashed in any way. Therefore, Basic Authentication is typically used in conjunction with HTTPS to provide confidentiality.

Protocol

Server side

When the server wants the user agent to authenticate itself towards the server, the server must respond appropriately to unauthenticated requests.

Client side

When the user agent wants to send authentication credentials to the server, it may use the Authorization field.

  • The username and password are combined with a single colon (:). This means that the username itself cannot contain a colon.
    • The resulting string is encoded into an octet sequence. The character set to use for this encoding is by default unspecified, as long as it is compatible with US-ASCII.
    • The resulting string is encoded using a variant of Base64.
    • The authorization method and a space (e.g. "Basic ") is then prepended to the encoded string.
      • For example, if the browser uses Aladdin as the username and OpenSesame as the password, then the field's value is the base64-encoding of Aladdin:OpenSesame, or QWxhZGRpbjpPcGVuU2VzYW1l. Then the Authorization header will appear as:
        • Authorization: Basic QWxhZGRpbjpPcGVuU2VzYW1l

Resource - Securing Passwords

Hackers love when you...

Store username/passwords in plaintext

Salt

Random data that is used as additional data and is appended to hashed passwords to add further security

Introduction to JSON Web Tokens (JWT)

Authentication Cheat Sheet

Clone this wiki locally