Authentication

Introduction#

RFC 7235 defines the HTTP authentication framework, which can be used by a server to challenge a client request, and by a client to provide authentication information.

Challenge-response flow#

The challenge and response flow work like this:

1. The server responds to a client with a 401 (Unauthorized) response status and provides information on how to authorize with a WWW-Authenticate response header containing at least one challenge.

2. A client that wants to authenticate itself with the server can then do so by including an Authorization request header with the credentials.

3. Usually a client will present a password prompt to the user and will then issue the request including the correct Authorization header.

The general message flow above is the same for most (if not all) authentication schemes. The actual information in the headers and the way it is encoded does change!