CyberCertPrepWeb App FundamentalsAuthentication BasicsEASYFree question
A website uses HTTP Basic Authentication. What is a security concern with this approach over plain HTTP?
- A.Basic authentication requires a special browser plugin
- B.It prevents users from using strong passwords
- C.Basic authentication only works with IPv6
- D.Credentials are Base64-encoded (not encrypted), meaning they are trivially decodable if intercepted in transit
Why D is correct
HTTP Basic Auth encodes credentials as Base64(username:password) in the Authorization header. Base64 is not encryption - it is trivially reversed. Over plain HTTP (no TLS), the credentials are effectively transmitted in cleartext and can be read by any network observer.
Know someone studying for Web App Fundamentals? Send them this one.