Search code examples
google-chromehttpurlwebbasic-authentication

URL-embedded credentials


Wikipedia says that HTTP Basic authentication relies on the Authorization header to provide credentials from the client to the server.

But it is also possible to embed the credentials in the URL:

http(s)://<user>:<password>@<host>/<path>

Is it something that is interpreted by the browser and converted into a Authorization header or is it directly sent to the server?


Solution

  • But it is also possible to embed the credentials in the URL

    Only if the browser is buggy in its support of HTTP, often deliberately so to be backwards compatible with browsers where people mistakenly thought this was a good idea.

    It's never been allowed by the HTTP scheme, though the URI syntax more generally does allow user information there.

    Is it something that is interpreted by the browser and converted into a Authorization header.

    Yes. If the server at sent a 401 the browser would reply using that username and password. There has been at least one that used to pre-emptively attempt Basic which was obviously a bad idea on top of the existing bad idea.