Hi and welcome back to the Knowledge Portal Video Series.
So today we're going to talk about a very interesting topic called as Http authentication.
So before we go into what exactly it is, let's take a real world scenario to understand where Http
authentication can be used.
So let's take an example.
So you have a website called as Example.com.
So this website is open to the Internet, so everyone from the Internet can access this particular website.
Now, generally you do not want or sometimes you might want that certain pages within your website should
only be allowed to particular person.
So say slash admin page.
So slash admin page you don't want the whole internet to access it.
So there has to be some kind of a authentication mechanism where if a user wants to open slash admin
page, then he has to authenticate.
And this is where the authentication comes into picture.
So here I have a small picture.
So it's something like if someone tries to open example.com slash admin.
Then Http will ask for an authentication where the user has to enter username and password, and if
both of them are correct, then the user will be able to open the page.
So if we talk about authentication.
So this is Http authentication.
There are two major types of them.
So one is basic.
Venous Digest.
And there is a third one which is empty as well.
So now is something which is not much used, but basic and digest based authentication are something
which is used frequently in many of the websites.
So let me show you on how exactly it works.
So let me open Internet Explorer.
And let's go to example.com.
And here you see, this is a knowledge portal video series.
So this is a normal website.
So if we want to go to some important critical pages like slash admin, then there will be a prompt
for username and password.
And this is what the Http authentication basically means.
So let me put in the username followed by the password.
And if I say okay, then the admin page opens up.
So this is an abstract overview of the Http authentication.
So let's see on how exactly it works internally.
So let's go down.
And this is what happens.
So the first step, the user sends a get request.
We have already seen the Http request and response headers.
So the very first thing that happens is the user sends a get request to slash admin.
And so this is the first thing.
So once the server.
So this is a server.
So once the server.
Receives the get request on slash admin page.
It will immediately send a 401.
401.
Basically means authorization is required.
That means you have to authenticate.
And along with the 401.
It sends a WW authenticate authenticate header saying what type of authentication mechanism it is using.
So here you see it is saying basic.
So you already see there are three types, basic and digest.
So this is what the authentication.
Type is.
And along with this, whenever the user receives the second request, they will see some kind of a form
with username and password credentials.
Now, as soon as the user fills the username and password and click on submit, the browser will send
the get request.
Again, get slash admin along with the username and password.
Now here you see the username and password are basically encoded by base64.
And then send to the client.
Now, remember, this is encoding and not encryption.
There is a difference between these two.
So before we go into all of these, let me show you the packet capture.
So let me open my wireshark and let's start the packet capture.
So I go to Firefox.
I'll go to example admin and here it is asking for username and password.
So I've already configured it on my nginx box.
See.
Okay.
And here you see, this is the secret admin page.
So let's look into the wireshark and see what exactly has happened.
So let's go bit up and get slash admin stats from here.
So let me follow the TCP stream.
And let's see what has happened.
So the browser has requested for slash admin page and there is in the response you see the server has
given 401 unauthorized and along with that it has sent a authenticate header asking the client to authenticate.
And this is when we see the username and password column.
Now, along with the authenticate, it is saying that the server has implemented basic authentication.
Now if we go a bit down.
Then you see this is the response.
Again, the get slash admin.
Now here it is saying authorization means it is providing an answer to basic authentication and this
is the username and the password which is encoded in the base64.
And then if we go down.
Then you see, you get a 200.
Okay.
Means the server has verified that the credentials are proper and it has given access.
Now this is a base64 encoded value, so if we just copy it.
In the browser just like base64 decoder.
And if you paste this value in the decode format, you'll actually get the.
Format back, which is admin and password.
So the username was admin and the password was password.
So if we talk about the base 64, all it does is it does the encoding.
So.
You can actually retrieve your plaintext data from the Base64 encoded value.
So in this type of scenarios.
So let's say this is a client, this is a client and this is a server.
Now, the client has sent a password to the server encoded with Base64.
Now, in this type of scenarios, if there is a hacker who is listening.
Over the network.
So this is a hacker bad guy.
And if he manages to capture this traffic, then even Hacker has the Base64 encoded format.
All he has to do is he has to decode the Base64 value and say Base64 value, and then he'll get the
original username and password back.
So.
This is one of the reasons why basic authentication by itself is not preferred.
Now, there are a lot of sites which still implement basic authentication, but if you want to implement
basic authentication, then you can use on top of SSL.
So if you use on top of SSL, then this whole data is encrypted.
So even if the hacker tries to get the data, it will be in a jumbled up format.
So the hacker won't be able to decode it.
So this is one of the reasons why Http basic authentication is ideally used along with SSL.
If it is not used, then it is very easy for a hacker to or hacker who is monitoring the traffic to
hack into the server.
So this is it about the base 64 and the basic Http authentication.
I hope this has been useful for you and I'd like to thank you for viewing.