Basic Auth - Instructions

The most basic form of HTTP authentication is Basic Authentication. Where a username and password are base64 encoded in an Authentication header.

Basic Authentication

When a page protected by basic authentication is accessed in a browser, a dialog will usually be shown so the user can enter a username and password.

This will then be sent to the server in an Authorization header.

To access the protected page, use the username and password

  • username: authorized
  • password: password001

After entering the details, a static result page will show whether the supplied credentials were accepted.

Explore Using the Dev Tools

Using the browser dev tools you can see the network traffic.

View the request send to the server and examine the Authorization header.

Explore using different combinations of input and see which states the server checks for.

Automating

Most tools for Automating Browsers have specific methods for accessing Basic Authenticated pages.

API Testing

You could also treat the protected page as an API and create the Authorization header in the API request.

To use as API:

  • Issue a GET to /pages/auth/basic-auth/basic-auth-protected.html
  • You should set the Accept header to application/json
  • You should add a Basic Authorization header e.g
    • Authorization: Basic YXV0aG9yaXplZDpwYXNzd29yZDAwMQ==

HTTP Client Exercises

Use an API client such as Bruno, Postman, Insomnia, or curl to explore the request and response details.

Try these checks:

  • request the protected URL with no Authorization header and check for a 401 response
  • check that the WWW-Authenticate response header is present on the challenge response
  • add Basic Auth credentials using your API client authentication helper
  • add the Authorization header manually and compare the generated value
  • change the Accept header between text/html, application/json, and */*
  • send an invalid Basic Auth value and compare the status code and response body
  • decode the Base64 payload and confirm that Basic Auth is just username:password, not encryption

Example curl request:

curl -i \
  -H "Accept: application/json" \
  -H "Authorization: Basic YXV0aG9yaXplZDpwYXNzd29yZDAwMQ==" \
  https://testpages.eviltester.com/pages/auth/basic-auth/basic-auth-protected.html

Useful things to observe:

  • Authorization is a request header
  • WWW-Authenticate is a response header
  • successful credentials and failed credentials are different from a missing header
  • browser Basic Auth dialogs can cache credentials, while API clients make the header more explicit