CyberCertPrepWeb App FundamentalsAuthentication BasicsEASYFree question
A website uses HTTP Basic Authentication. What is a security concern with this approach over plain HTTP?
- A.Credentials are Base64-encoded (not encrypted), meaning they are trivially decodable if intercepted in transit
- B.Passwords are sent in clear text (not hashed), meaning any device on the network path can read them from the Authorization header
- C.Credentials are stored in a cookie (not in a header), meaning the browser sends them to each site that the user visits in a session
- D.Passwords are limited to 8 characters (a protocol limit), meaning long passphrases are cut
Why A is correct
HTTP Basic Auth encodes credentials as Base64(username:password) in the Authorization header. Base64 is not encryption - it is trivially reversed. Over plain HTTP (no TLS), the credentials are effectively transmitted in cleartext and can be read by any network observer.
Know someone studying for Web App Fundamentals? Send them this one.