Basic authentication in Rest API - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Basic Authentication in REST APIs?

Basic Authentication is a simple method to secure REST APIs by sending a username and password encoded in Base64 with each request.

beginner

How is the username and password sent in Basic Authentication?

They are combined as 'username:password', then encoded using Base64, and sent in the HTTP header as 'Authorization: Basic <encoded_string>'.

intermediate

Why is Basic Authentication considered insecure over plain HTTP?

Because the Base64 encoded credentials can be easily decoded if intercepted, so it should only be used over HTTPS to encrypt the connection.

intermediate

What HTTP status code does a server return when Basic Authentication fails?

The server returns 401 Unauthorized status code and includes a 'WWW-Authenticate' header to prompt the client for credentials.

beginner

How does a client include Basic Authentication credentials in a REST API request?

The client adds an HTTP header: 'Authorization: Basic <Base64 encoded username:password>'.

What does the 'Authorization' header contain in Basic Authentication?

A Basic followed by Base64 encoded username and password

B Bearer token

C API key in plain text

D Encrypted JSON Web Token

Basic Authentication sends 'Authorization: Basic '.

Why should Basic Authentication be used only over HTTPS?

A Because HTTP does not support headers

B Because HTTPS speeds up the request

C Because Base64 encoding is not encryption and can be decoded easily

D Because HTTPS changes the username automatically

Base64 encoding is just encoding, not encryption, so credentials can be intercepted if not sent over HTTPS.

What HTTP status code indicates failed Basic Authentication?

A 404 Not Found

B 200 OK

C 403 Forbidden

D 401 Unauthorized

401 Unauthorized means the client must provide valid credentials.

How are username and password combined before encoding in Basic Authentication?

A username,password

B username:password

C password|username

D password:username

They are combined as 'username:password' before Base64 encoding.

Which header does the server send to request Basic Authentication credentials?

A WWW-Authenticate

B Authorization

C Content-Type

D Accept

The server sends 'WWW-Authenticate' header to ask the client for credentials.

Explain how Basic Authentication works in REST APIs.

Think about how credentials are sent and protected.

Describe why Basic Authentication is not secure on its own and how to improve its security.

Focus on the difference between encoding and encryption.