Basic Authentication (2024)

FAQs

Basic Authentication? ›

Basic Authentication is a method for an HTTP user agent (e.g., a web browser) to provide a username and password when making a request.

Unlike Basic Auth, where you have to share your password with people who need to access your user account, OAuth doesn't share password data. Instead, OAuth uses authorization tokens to verify an identity between consumers and service providers.

Basic authentication is now disabled in all tenants. Before December 31 2022, you could re-enable the affected protocols if users and apps in your tenant couldn't connect. Now no one (you or Microsoft support) can re-enable Basic authentication in your tenant.

Basic authentication is a simple authentication scheme built into the HTTP protocol. The client sends HTTP requests with the Authorization header that contains the word Basic word followed by a space and a base64-encoded string username:password . For example, to authorize as demo / p@55w0rd the client would send.

Enhanced Security: Bearer Token is more secure than Basic Authentication, especially when used over secure channels (like HTTPS). They can also be designed to include features like token expiration and revocation.

API key-based authentication provides a more secure and scalable alternative to basic authentication, since the API key can be easily revoked or regenerated if it is compromised, and it allows the API provider to monitor and control access to the API more granularly.

Microsoft recently announced a major change in the effort to protect their users' data In Exchange Online from cyber threats. By September 2025, the increasingly outdated Basic auth method will have been phased out completely and replaced by the OAuth protocol when using Microsoft email relay functionality (SMTP AUTH).

As well as basic authentication, there are other ways to implement authentication such as bearer authentication, form-based authentication, API keys and OAuth.

Problems with Basic Authentication

Although they are encoded with Base64, this does not add any security since they can be decoded easily. Most configurations of Basic Authentication do not implement protection against password brute forcing.

Token-based authentication is one of the most secure methods of authenticating REST APIs. They minimize interception risk since they can be encrypted and are usually short-lived, and they can offer granular access control. However, tokens require careful design and infrastructure considerations.

Why do we use basic authentication? ›

HTTP Basic authentication (BA) implementation is the simplest technique for enforcing access controls to web resources because it does not require cookies, session identifiers, or login pages; rather, HTTP Basic authentication uses standard fields in the HTTP header.

The "Basic" HTTP authentication scheme is defined in RFC 7617, which transmits credentials as user ID/password pairs, encoded using base64.

Password-based authentication

Passwords are the most common methods of authentication. Passwords can be in the form of a string of letters, numbers, or special characters. To protect yourself you need to create strong passwords that include a combination of all possible options.

However, always use an SSL encryption in combination with basic authentication to secure user account information being transmitted over the network. If the functionality of the intended application is basic, then basic authentication is the way to go.

OAuth is primarily focused on enabling authorization for APIs. Auth0 and OAuth can be used together to build secure and scalable authentication and authorization solutions. OAuth can be used to grant access to APIs, while Auth0 can be used to manage the authentication and authorization process for your applications.

Basic authentication is vulnerable to replay attacks. Because basic authentication does not encrypt user credentials, it is important that traffic always be sent over an encrypted SSL session. A user authenticating with basic authentication must provide a valid username and password.

OAuth is more secure than Basic Authentication because, even though credentials are used to get an access token, the token has limited use and duration. It's like having a temporary key that minimizes the chance of exposing sensitive data, compared to Basic Authentication, where credentials are sent with every request.