Basic authentication in Rest API - Mini Project: Build & Apply

Basic Authentication in a REST API

📖 Scenario: You are building a simple REST API that requires users to log in with a username and password. To keep things safe, the API uses basic authentication, which means the client sends a username and password encoded in a special way with each request.This project will guide you step-by-step to create a basic authentication check in your API.

🎯 Goal: Build a REST API endpoint that checks the username and password sent by the client using basic authentication. If the credentials are correct, the API will respond with a welcome message. If not, it will respond with an error message.

📋 What You'll Learn

Create a dictionary called users with exact username-password pairs

Create a variable called auth_header to hold the incoming authorization header string

Decode the base64 encoded credentials from auth_header and split into username and password

Check if the username and password match the users dictionary and print the correct response

💡 Why This Matters

🌍 Real World

Basic authentication is a simple way to protect API endpoints by requiring users to send their username and password encoded in each request.

💼 Career

Understanding basic authentication helps you build secure APIs and is a foundation for learning more advanced authentication methods used in web development jobs.

1

Create the user credentials dictionary

Create a dictionary called users with these exact entries: 'alice': 'wonderland', 'bob': 'builder', and 'charlie': 'chocolate'.

Rest API

# Create the users dictionary with username-password pairs
# Your code here

Hint

Use curly braces {} to create a dictionary and separate each username and password with a colon.

2

Set the authorization header string

Create a variable called auth_header and set it to the exact string 'Basic YWxpY2U6d29uZGVybGFuZA=='. This string represents the username and password encoded in base64.

Rest API

users = {'alice': 'wonderland', 'bob': 'builder', 'charlie': 'chocolate'}
# Set the auth_header variable to the given base64 encoded string
# Your code here

Hint

Assign the exact string to auth_header including the word Basic and the encoded part.

3

Decode and extract username and password

Import the base64 module. Then decode the base64 part of auth_header (after the space) to get a string like username:password. Split this string by ':' into variables username and password.

Rest API

users = {'alice': 'wonderland', 'bob': 'builder', 'charlie': 'chocolate'}
auth_header = 'Basic YWxpY2U6d29uZGVybGFuZA=='
# Import base64 and decode the credentials
# Your code here

Hint

Use auth_header.split(' ')[1] to get the encoded part. Then use base64.b64decode() and decode to UTF-8 string. Finally, split by ':'.

4

Check credentials and print response

Use an if statement to check if username is in users and if password matches users[username]. If both are true, print f"Welcome, {username}!". Otherwise, print "Authentication failed.".

Rest API

import base64

users = {'alice': 'wonderland', 'bob': 'builder', 'charlie': 'chocolate'}
auth_header = 'Basic YWxpY2U6d29uZGVybGFuZA=='

encoded_credentials = auth_header.split(' ')[1]
decoded_bytes = base64.b64decode(encoded_credentials)
decoded_str = decoded_bytes.decode('utf-8')
username, password = decoded_str.split(':')

# Check credentials and print the correct message
# Your code here

Hint

Use if username in users and users[username] == password: to check credentials.

Practice

1. What does Basic Authentication in REST API primarily use to verify a user?

easy

A. An API key sent as a query parameter

B. A username and password encoded in base64 sent in the Authorization header

C. OAuth tokens in the request body

D. IP address filtering

Solution

1. Step 1: Understand Basic Authentication mechanism

   Basic Authentication sends a username and password encoded in base64 in the Authorization header.

2. Step 2: Compare with other authentication methods

   API keys, OAuth tokens, and IP filtering are different methods, not Basic Authentication.

3. Final Answer:

   A username and password encoded in base64 sent in the Authorization header -> Option B

4. Quick Check:

   Basic Auth = username:password base64 in header [OK]

Hint: Basic Auth always uses base64 username:password in header [OK]

Common Mistakes:

• Confusing Basic Auth with API key or OAuth
• Thinking credentials are sent in URL or body
• Ignoring base64 encoding step

2. Which of the following is the correct format of the Authorization header for Basic Authentication?

easy

A. Authorization: ApiKey base64encodedstring

B. Authorization: Bearer base64encodedstring

C. Authorization: Token base64encodedstring

D. Authorization: Basic base64encodedstring

Solution

1. Step 1: Recall the header format for Basic Authentication

   The header must start with the word 'Basic' followed by a space and then the base64 encoded credentials.

2. Step 2: Eliminate other header types

   'Bearer', 'Token', and 'ApiKey' are used in other authentication schemes, not Basic Auth.

3. Final Answer:

   Authorization: Basic base64encodedstring -> Option D

4. Quick Check:

   Basic Auth header starts with 'Basic' [OK]

Hint: Basic Auth header always starts with 'Basic ' [OK]

Common Mistakes:

• Using 'Bearer' instead of 'Basic'
• Omitting the space after 'Basic'
• Confusing with other auth schemes

3. Given the username 'user' and password 'pass', what is the value of the Authorization header in Basic Authentication?

medium

A. Authorization: Basic dXNlcjpwYXNz

B. Authorization: Basic dXNlcjpwYXNzCg==

C. Authorization: Basic dXNlcjpwYXNzdA==

D. Authorization: Basic dXNlcjpwYXNzZA==

Solution

1. Step 1: Combine username and password with colon

   Combine 'user' and 'pass' as 'user:pass'.

2. Step 2: Encode 'user:pass' in base64

   Encoding 'user:pass' in base64 results in 'dXNlcjpwYXNzdA=='.

3. Final Answer:

   Authorization: Basic dXNlcjpwYXNzdA== -> Option C

4. Quick Check:

   Base64('user:pass') = dXNlcjpwYXNzdA== [OK]

Hint: Encode 'username:password' in base64 for header value [OK]

Common Mistakes:

• Encoding username and password separately
• Adding extra characters or padding incorrectly
• Using wrong base64 string

4. What is wrong with this Basic Authentication header?
Authorization: Basic user:pass

medium

A. The username and password are not base64 encoded

B. The header should be 'Bearer' not 'Basic'

C. The colon ':' should be replaced with a comma ','

D. The header is missing the word 'Authorization'

Solution

1. Step 1: Check the format of the Authorization header

   The header must have the credentials base64 encoded after 'Basic '.

2. Step 2: Identify the error in the given header

   The given header has 'user:pass' in plain text, not base64 encoded.

3. Final Answer:

   The username and password are not base64 encoded -> Option A

4. Quick Check:

   Basic Auth requires base64 encoding [OK]

Hint: Credentials must be base64 encoded, not plain text [OK]

Common Mistakes:

• Sending plain text credentials
• Confusing 'Basic' with 'Bearer'
• Misplacing colon or other punctuation

5. You want to protect a REST API endpoint using Basic Authentication. Which of the following is the best practice?

hard

A. Use HTTPS to encrypt the connection and send base64 encoded credentials in the Authorization header

B. Send username and password in plain text over HTTP

C. Send credentials as URL parameters for easy access

D. Use Basic Authentication without encoding credentials

Solution

1. Step 1: Understand security risks of Basic Authentication

   Basic Auth sends credentials encoded but not encrypted, so it must be used over HTTPS to protect data.

2. Step 2: Identify best practice for secure API protection

   Using HTTPS encrypts the entire connection, making base64 encoded credentials safe to transmit.

3. Final Answer:

   Use HTTPS to encrypt the connection and send base64 encoded credentials in the Authorization header -> Option A

4. Quick Check:

   Basic Auth + HTTPS = secure transmission [OK]

Hint: Always use HTTPS with Basic Auth for security [OK]

Common Mistakes:

• Sending credentials over HTTP (not secure)
• Putting credentials in URL parameters
• Skipping base64 encoding