files/en-us/web/http/reference/headers/authorization/index.md
The HTTP Authorization {{Glossary("request header")}} can be used to provide credentials that authenticate a user agent with a server, allowing access to protected resources.
The Authorization header is usually, but not always, sent after the user agent first attempts to request a protected resource without credentials.
The server responds with a {{HTTPStatus("401", "401 Unauthorized")}} message that includes at least one {{HTTPHeader("WWW-Authenticate")}} header.
This header indicates the authentication schemes that can be used to access the resource and any additional information needed by the client to use them.
The user-agent should select the most secure authentication scheme that it supports from those offered, prompt the user for their credentials, and then re-request the resource with the encoded credentials in the Authorization header.
This header is stripped from cross-origin redirects.
<table class="properties"> <tbody> <tr> <th scope="row">Header type</th> <td>{{Glossary("Request header")}}</td> </tr> <tr> <th scope="row">{{Glossary("Forbidden request header")}}</th> <td>No</td> </tr> </tbody> </table>[!NOTE] This header is part of the General HTTP authentication framework. It can be used with a number of authentication schemes.
Authorization: <auth-scheme> <authorization-parameters>
// Basic authentication
Authorization: Basic <credentials>
// Digest authentication
Authorization: Digest username=<username>,
realm="<realm>",
uri="<url>",
algorithm=<algorithm>,
nonce="<nonce>",
nc=<nc>,
cnonce="<cnonce>",
qop=<qop>,
response="<response>",
opaque="<opaque>"
<auth-scheme>
: The Authentication scheme that defines how the credentials are encoded.
Some of the more common types are (case-insensitive): Basic, Digest, Negotiate and AWS4-HMAC-SHA256.
[!NOTE] For more information/options see HTTP Authentication > Authentication schemes
Other than <auth-scheme>, the remaining directives are specific to each authentication scheme.
Generally, you will need to check the relevant specifications for these (keys for a small subset of schemes are listed below).
<credentials>
: The credentials, encoded according to the specified scheme.
[!NOTE] For information about the encoding algorithm, see the examples: below, in {{HTTPHeader("WWW-Authenticate")}}, in HTTP Authentication, and in the relevant specifications.
<response>
username
realm in either plain text or the hash code in hexadecimal notation.
If the name contains characters that aren't allowed in the field, then username* can be used instead (not "as well").username*
username and if userhash is set "false".uri
realm
opaque
algorithm
qop
"auth": Authentication"auth-int": Authentication with integrity protectioncnonce
nc
cnonce value (including the current request).
The server can use duplicate nc values to recognize replay requests.userhash {{optional_inline}}
"true" if the username has been hashed. "false" by default.For Basic authentication, the credentials are constructed by first combining the username and the password with a colon (e.g., aladdin:opensesame), and then by encoding the resulting string in base64 (e.g., YWxhZGRpbjpvcGVuc2VzYW1l).
Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l
[!WARNING] {{Glossary("Base64")}}-encoding can easily be reversed to obtain the original name and password, so
Basicauthentication offers no cryptographic security. {{Glossary("HTTPS")}} is always recommended when using authentication, but is even more so when usingBasicauthentication.
See also HTTP authentication for examples on how to configure Apache or Nginx servers to password protect your site with HTTP basic authentication.
{{Specifications}}
{{Compat}}