I&#39;m working on a site that uses basic authentication. Using Chrome I&#39;ve logged in using the basic auth. I now want to remove the basic authentication details from the browser and try a different login.

How do you clear the current basic authentication details when using Chrome?

How to clear basic authentication details in chrome

I&#39;m setting up basic authentication on a php site and found [this][1] page on the php manual showing the set up.  What does &quot;realm&quot; mean here in the header? 

    header(&#39;WWW-Authenticate: Basic realm=&quot;My Realm&quot;&#39;);

 Is it the page page being requested?

  [1]: http://php.net/manual/en/features.http-auth.php

What is the &quot;realm&quot; in basic authentication

Is it possible to log out user from a web site if he is using basic authentication?

Killing session is not enough, since, once user is authenticated, each request contains login info, so user is automatically logged in next time he/she access the site using the same credentials.

The only solution so far is to close browser, but that&#39;s not acceptable from the usability standpoint.


How to log out user from web site using BASIC authentication?

I&#39;m learning Apigility ([Apigility docu -&gt; REST Service Tutorial](https://www.apigility.org/documentation/intro/first-rest-service)) and trying to send a POST request with basic authentication via cURL:

    $ curl -X POST -i -H &quot;Content-Type: application/hal+json&quot; -H &quot;Authorization: Basic YXBpdXNlcjphcGlwd2Q=&quot; http://apigilityhw.sandbox.loc/status

`YXBpdXNlcjphcGlwd2Q=` is the base 64 encoded string with my credentials `apiuser:apipwd`. The credentials are saved in the `/data/htpasswd` (`apiuser:$apr1$3J4cyqEw$WKga3rQMkxvnevMuBaekg/`).

The looks like this:

    HTTP/1.1 401 Unauthorized
    Server: nginx/1.4.7
    Date: Mon, 22 Sep 2014 07:48:47 GMT
    Content-Type: application/problem+json
    Transfer-Encoding: chunked
    Connection: keep-alive
    X-Powered-By: PHP/5.5.12-1~dotdeb.1
    WWW-Authenticate: Basic realm=&quot;api&quot;

Where is the mistake here? How to get it work?

How to define the basic HTTP authentication using cURL correctly?

I&#39;m building a REST web service client in PHP and at the moment I&#39;m using curl to make requests to the service.

How do I use curl to make authenticated (http basic) requests? Do I have to add the headers myself?


How do I make a request using HTTP basic authentication with PHP curl?

When a server allows access via Basic HTTP Authentication, what is the experience expected to be **in a web browser**?

Ignoring the web browser for a moment, here&#39;s how to create a Basic Auth request with `curl`:

    curl -u myusername:mypassword http://somesite.com

But what about in a Web Browser? What I&#39;ve seen on some websites, is I visit the URL, and then the server returns response code 401. The browser then displays a username/password prompt.

However, on somesite.com, I&#39;m not getting an authorization prompt at all, just a page that says I&#39;m not authorized. Did somesite not implement the Basic Auth workflow correctly, or is there something else I need to do?


HTTP Basic Authentication - what&#39;s the expected web browser experience?

I have a question about HTTPS and HTTP Authentication credentials.

Suppose I secure a URL with HTTP Authentication:

    &lt;Directory /var/www/webcallback&gt;
    AuthType Basic
    AuthName &quot;Restricted Area&quot;
    AuthUserFile /var/www/passwd/passwords
    Require user gooduser
    &lt;/Directory&gt;

I then access that URL from a remote system via HTTPS, passing the credentials in the URL:

    https://gooduser:secretpassword@www.example.com/webcallback?foo=bar

Will the username and password be automatically SSL encrypted? Is the same true for GETs and POSTs? I&#39;m having a hard time locating a credible source with this information.

HTTP Basic Authentication credentials passed in URL and encryption

What is the difference between *Digest* and *Basic* Authentication ?

What is the difference between Digest and Basic Authentication?

With cURL, we can pass a username with an HTTP web request as follows: 

    $ curl -u &lt;your_username&gt; https://api.github.com/user

The `-u` flag accepts a username for authentication, and then cURL will request the password. The cURL example is for [Basic authentication with the GitHub Api][1].

How do we similarly pass a username and password along with Invoke-WebRequest? The ultimate goal is to user PowerShell with Basic authentication in the GitHub API.

  [1]: https://developer.github.com/v3/auth/



Use Invoke-WebRequest with a username and password for basic authentication on the GitHub API

I am currently developing a REST-API which is HTTP-Basic protected for the development environment. As the real authentication is done via a token, I&#39;m still trying to figure out, how to send two authorization headers.

I have tried this one:

    curl -i http://dev.myapp.com/api/users \
      -H &quot;Authorization: Basic Ym9zY236Ym9zY28=&quot; \
      -H &quot;Authorization: Bearer mytoken123&quot;

I could for example disable the HTTP-Authentication for my IP but as I usually work in different environments with dynamic IPs, this is not a good solution. So am I missing something?

Basic HTTP and Bearer Token Authentication

I have created JWT based Authentication in my Web API application.
I am not able to figure out the difference between

 1. Basic Token
 2. Bearer Token

Can someone please help me?

Web API Authentication Basic vs Bearer

I need to send authorization request using basic auth. I have successfully implemented this using jquery. However when I get 401 error basic auth browser popup is opened and jquery ajax error callback is not called.





How to prevent browser to invoke basic auth popup and handle 401 error using Jquery?

As per title, how do I do that?

Here is my code: 

    var http = require(&#39;http&#39;);

    // to access this url I need to put basic auth.
    var client = http.createClient(80, &#39;www.example.com&#39;);
    
    var request = client.request(&#39;GET&#39;, &#39;/&#39;, {
        &#39;host&#39;: &#39;www.example.com&#39;
    });
    request.end();
    request.on(&#39;response&#39;, function (response) {
      console.log(&#39;STATUS: &#39; + response.statusCode);
      console.log(&#39;HEADERS: &#39; + JSON.stringify(response.headers));
      response.setEncoding(&#39;utf8&#39;);
      response.on(&#39;data&#39;, function (chunk) {
        console.log(&#39;BODY: &#39; + chunk);
      });
    });

How to use http.client in Node.js if there is basic authorization

The RFC2617 says to encode the username and password to base64 but don&#39;t say what character encoding to use when creating the octets for input into the base64 algorithm.

Should I assume US-ASCII or UTF8?  Or has someone settled this question somewhere already?

What encoding should I use for HTTP Basic Authentication?

I&#39;d like to add basic authentication to my website. I followed the instructions in the MSDN article on [Configure Basic Authentication (IIS 7)][1]

&gt;###To use the UI
&gt;1. Open IIS Manager and navigate to the level you want to manage. For information about opening IIS Manager, see [Open IIS Manager (IIS 7)][2]. For information about navigating to locations in the UI, see [Navigation in IIS Manager (IIS 7)][3].
2. In **Features View**, double-click **Authentication**.
3. On the **Authentication** page, select **Basic Authentication**.
4. In the **Actions** pane, click **Enable** to use Basic authentication with the default settings.
5. Optionally, in the **Actions** pane, click **Edit** to type the default domain and realm.
6. In the **Edit Basic Authentication Settings** dialog box, in the **Default domain** text box, type a default domain or leave it blank. Users who do not provide a domain when they log on to your site are authenticated against this domain.
7. In the **Realm** text box, type a realm or leave it blank. In general, you can use the same value for the realm name as you used for the default domain.  
  *  **Important**  
    If you enter the default domain name in the Realm text box, your internal Microsoft Windows domain name may be exposed to external users during the user name and password challenge.
&gt; 8.  Click **OK** to close the **Edit Basic Authentication Settings** dialog box.

Here&#39;s what I&#39;ve done so far:

[![IIS Manager - Authentication][4]][4]
[![Authentication Page - Basic Authentication][5]][5]


Now I need to create a user account for the basic authentication.

Does anyone know how to create users in IIS Manager?


  [1]: http://technet.microsoft.com/en-us/library/cc772009.aspx
  [2]: http://technet.microsoft.com/en-us/library/cc770472.aspx
  [3]: http://technet.microsoft.com/en-us/library/cc732920.aspx
  [4]: http://i.stack.imgur.com/jOPCC.png
  [5]: http://i.stack.imgur.com/0IbZX.png

How do I create a user account for basic authentication?

I&#39;m trying to do basic HTTP auth with the code below, but it is throwing out the following error:

&gt; 2013/05/21 10:22:58 Get mydomain.com: unsupported protocol scheme &quot;&quot;
&gt; exit status 1

    func basicAuth() string {
        var username string = &quot;foo&quot;
        var passwd string = &quot;bar&quot;
        client := &amp;http.Client{}
        req, err := http.NewRequest(&quot;GET&quot;, &quot;mydomain.com&quot;, nil)
        req.SetBasicAuth(username, passwd)
        resp, err := client.Do(req)
        if err != nil{
            log.Fatal(err)
        }
        bodyText, err := ioutil.ReadAll(resp.Body)
        s := string(bodyText)
        return s
    }

Any idea what I may be doing wrong?

Basic HTTP Auth in Go

What is the equivalent of

    curl -u username:password ...

in PowerShell&#39;s `Invoke-RestMethod`? I tried this:


    $securePwd = ConvertTo-SecureString &quot;password&quot; -AsPlainText -Force
    $credential = New-Object System.Management.Automation.PSCredential ($username, $securePwd)

    Invoke-RestMethod -Credential $credential ...


but it returns 401, Unauthorized.

PowerShell&#39;s Invoke-RestMethod equivalent of curl -u (Basic Authentication)

I want to do basic access authentication using Guzzle and I am very new to programming. I have no clue what to do. I tried to do this using curl but my environment requires using guzzle.

How do I do HTTP basic authentication using Guzzle?

I am trying to write some simple tests User Authentication mechanism which uses Basic Authentication. How can I retrieve the credentials from the header?

    string authorizationHeader = this.HttpContext.Request.Headers[&quot;Authorization&quot;];

Where do I go from here? There are several tutorials but I new to .NET and authentication, could you explain in your answer exactly step-by-step the what and why you are doing.


How can I retrieve Basic Authentication credentials from the header?

HTTP basic authentication credentials are stored until the browser is closed, but is there a way to remove the credentials before the browser is closed?

I read about a [trick with HTTP 401 status code][1], but it seems to [work not properly][2] (see comment to answer). Maybe the [mechanism trac uses is the solution][3].

Can the credentials be deleted with JavaScript? Or with a combination of JavaScript and the status 401 trick?


  [1]: https://stackoverflow.com/questions/449788/http-authentication-logout-via-php/449914#449914
  [2]: https://stackoverflow.com/questions/449788/http-authentication-logout-via-php/449813#449813
  [3]: http://trac-hacks.org/wiki/TrueHttpLogoutPatch

http basic authentication &quot;log out&quot;

Using Apache, it is quite simple to set up a page that uses basic access authentication to prompt a user for a name/password and use those credentials in some way to grant access to that user.

Is this secure, assuming the connection between the client and server is secure?

Is basic access authentication secure?

When using http basic authentication, the username can be passed in the URL, e.g.

    http://david@foo.com/path/

But now suppose the username is an email address, e.g. david@company.com. Doing this is clearly ambiguous:

    http://david@company.com@foo.com/path/

Is there a way to escape the @ character in the username? I tried standard URL encoding:

    http://david%40company.com@foo.com/path/

But that didn&#39;t do it.

Escaping username characters in basic auth URLs

I do not have the option for Basic Authentication in IIS Manager under IIS=&gt;Authentication.  I do have the following options:

    Anonymous Authentication
    ASP.NET Impersonation
    Forms Authentication

I am using Windows 7  professional N, and according to [this][1], Basic Authentication should be available to me.   

Does anyone have any ideas?  

  [1]: http://technet.microsoft.com/en-us/library/cc753473.aspx

No Basic Authentication choice available in IIS7

I&#39;m currently creating an authentication system on front of a public web API for a web application. Given that each user account has an API key and each request must be authenticated, I have two alternatives:

1. Using an HTTP Basic Authentication, [like GitHub does][1].

    Requests must be sent to the URL

        http://api.example.com/resource/id
        with basic authentication
        username: token
        password: the api key

2. Passing the API Token as querystring parameter.

    Requests must be sent to the URL

        http://api.example.com/resource/id?token=api_key

There&#39;s also a third option which is passing the token within the URI, but I honestly don&#39;t like that solution.

Which solution would you adopt and why?


  [1]: http://developer.github.com/guides/basics-of-authentication/

API Design: HTTP Basic Authentication vs API Token

Where can I find reference code that implements a HTTP Basic Authentication client in pure JavaScript, suitable for AJAX?

Extra points for code, or pointers to code, that can be used independent of JS toolkits like YUI. No points for Java, Flash/Flex, PHP frameworks, etc.

Pure JavaScript code for HTTP Basic Authentication?

**Question**

How can I implement Basic Authentication with Custom Membership in an ASP.NET Core web application?


**Notes**

- In MVC 5 I was using the instructions in this [article][1] which requires adding a module in the `WebConfig`.

- I am still deploying my new `MVC Core`application on `IIS` but this approach seems not working. 

- I also do not want to use the IIS built in support for Basic authentication, since it uses Windows credentials.

  [1]: http://www.asp.net/web-api/overview/security/basic-authentication

Basic Authentication in ASP.NET Core

Is it possible to have an .htaccess/.htpasswd access control setup for a given directory, but if they are from a specific IP address, bypass the login/password authentication?

I know you can do something like this in the .htaccess file:

    order deny,allow
    deny from all
    allow from 000.000.000.000

But if you add something along these lines:

    AuthType Basic
    AuthName &quot;restricted area&quot;
    AuthUserFile /path/to/.htpasswd
    require valid-user

Then it prompts for the password. Is there any way to do an if/else type setup, or some other solution so that users as a given IP (or set of IPs) don&#39;t get prompted for a password, but everyone else does?


.htaccess / .htpasswd bypass if at a certain IP address

Is there an easier way to setup the http client for preemptive basic authentication than what described [here][1]?  
In previous version (3.x) it used to be a simple method call (eg, `httpClient.getParams().setAuthenticationPreemptive(true)`).  
The main thing I want to avoid is adding the BasicHttpContext to each method I execute.


  [1]: http://svn.apache.org/repos/asf/httpcomponents/httpclient/branches/4.0.x/httpclient/src/examples/org/apache/http/examples/client/ClientPreemptiveBasicAuthentication.java

Preemptive Basic authentication with Apache HttpClient 4

I have spring web application with Spring security configured using java config approach. I want to exclude some URL patterns from authentication(eg: static resources etc..). I have done this earlier with spring security xml config but couldn&#39;t figure out with java config as adding antmatchers doesn&#39;t help.

Following is my code added in security config class extending WebSecurityConfigurerAdapter

    @Override
	public void configure(HttpSecurity http) throws Exception {
		http.authorizeRequests()
				.antMatchers(&quot;/authFailure&quot;)
				.permitAll()
				.anyRequest()
				.authenticated()
				.and()
				.httpBasic()
				.and()
				.authenticationProvider(_provider)
				.sessionManagement()
				.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
				.and()
				.addFilter(authFilter())
				.addFilterAfter(executionContextFilter(),
						TokenBasedSecurityFilter.class).csrf().disable();
	}

The spring security version that I use is 3.2.0. Thanks in advance for helping

&lt;b&gt;Edit:&lt;/b&gt;

The stacktrace that I got while hitting the excluded URL,

    org.springframework.security.authentication.AuthenticationServiceException: Authorization Header is not available in the request
    	at com.inventory.ricemill.tba.spring.TokenBasedSecurityFilter.doFilter(TokenBasedSecurityFilter.java:59)
    	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    	at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:110)
    	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    	at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:57)
    	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    	at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
    	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    	at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50)
    	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    	at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
    	at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
    	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:343)
    	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:260)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
    	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)
    	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
    	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:502)
    	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
    	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:100)
    	at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:953)
    	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
    	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)
    	at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1041)
    	at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:603)
    	at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310)
    	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
    	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
    	at java.lang.Thread.run(Thread.java:744)
    
    Apr 01, 2014 10:18:41 PM org.apache.catalina.core.StandardWrapperValve invoke
    SEVERE: Servlet.service() for servlet [Inventory] in context with path [/ricemill] threw exception [Request processing failed; nested exception is org.springframework.security.authentication.AuthenticationServiceException: Authorization Header is not available in the request] with root cause
    org.springframework.security.authentication.AuthenticationServiceException: Authorization Header is not available in the request
    	at com.inventory.ricemill.tba.spring.TokenBasedSecurityFilter.doFilter(TokenBasedSecurityFilter.java:59)
    	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    	at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:110)
    	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    	at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:57)
    	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    	at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
    	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    	at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50)
    	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    	at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
    	at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
    	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:343)
    	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:260)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
    	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)
    	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
    	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:502)
    	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
    	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:100)
    	at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:953)
    	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
    	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)
    	at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1041)
    	at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:603)
    	at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310)
    	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
    	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
    	at java.lang.Thread.run(Thread.java:744)


The request goes through the filters registered in spring security filter chain, while it shouldn&#39;t as the request is ignored with antmatcher

Spring Security exclude url patterns in security annotation configurartion

I&#39;m trying to write a REST-API server with NodeJS like the one used by [Joyent][1], and everything is ok except I can&#39;t verify a normal user&#39;s authentication. If I jump to a terminal and do `curl -u username:password localhost:8000 -X GET`, I can&#39;t get the values username:password on the NodeJS http server. If my NodeJS http server is something like 

    var http = require(&#39;http&#39;);
    http.createServer(function (req, res) {
      res.writeHead(200, {&#39;Content-Type&#39;: &#39;text/plain&#39;});
      res.end(&#39;Hello World\n&#39;);
    }).listen(1337, &quot;127.0.0.1&quot;);

, shouldn&#39;t I get the values username:password somewhere in the **req** object that comes from the callback ?
How can I get those values without having to use [Connect&#39;s basic http auth][2] ?


  [1]: http://api.no.de
  [2]: http://senchalabs.github.com/connect/middleware-basicAuth.html

All Basic Authentication Solutions on Gang of Coders

Total of 30 Basic Authentication Solutions