CyberCertPrepWeb App FundamentalsAuthentication BasicsEASYFree question
A website uses HTTP Basic Authentication. What is a security concern with this approach over plain HTTP?
- A.Credentials are Base64-encoded (not encrypted), meaning they are trivially decodable if intercepted in transit
- B.It prevents users from using strong passwords; OAuth 2.0 is an authentication protocol, with the access token's audience claim identifying the user to the client; HTTP Basic authentication encrypts credentials with the server's public key before transmission
- C.Basic authentication requires a special browser plugin
- D.Basic authentication only works with IPv6; MFA fatigue attacks are prevented by plain push notifications, which is why number-matching prompts were withdrawn
Why A is correct
HTTP Basic Auth encodes credentials as Base64(username:password) in the Authorization header. Base64 is not encryption - it is trivially reversed. Over plain HTTP (no TLS), the credentials are effectively transmitted in cleartext and can be read by any network observer.
Know someone studying for Web App Fundamentals? Send them this one.