Beginner LevelAuthentication & Authorization
Compare HTTP Basic Authentication versus Bearer Token Authentication.
❓ Interview Prompt: Explain HTTP Authorization header syntax, Base64 encoding in Basic Auth, and Bearer token transmission.
Both Basic and Bearer authentication transmit credentials inside the standard HTTP 'Authorization' request header, but use different formats:
1. HTTP Basic Authentication ('Authorization: Basic <credentials>'):
•
Transmits Base64-encoded 'username:password' string (e.g. 'Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=').
•
Stateless & Simple, but sends raw user credentials on every single API request.
•
Requires HTTPS to prevent credential sniffing. Cannot enforce fine-grained scope permissions easily.
2. HTTP Bearer Token Authentication ('Authorization: Bearer <token>'):
•
Transmits an opaque or signed security token (e.g. JWT or OAuth access token).
•
The caller ("bearer") presenting the token is granted access without disclosing raw user passwords.
•
Supports token expiration, scopes, and instant server-side revocation.
Code Implementation Example
typescript
// Middleware handling Basic vs Bearer Auth headers
function parseAuthHeader(authHeader?: string) {
if (!authHeader) throw new Error('Missing Authorization header');
const [scheme, credentials] = authHeader.split(' ');
if (scheme === 'Basic') {
const decoded = Buffer.from(credentials, 'base64').toString('utf-8');
const [username, password] = decoded.split(':');
return { type: 'Basic', username, password };
} else if (scheme === 'Bearer') {
return { type: 'Bearer', token: credentials };
}
}💡Parsing HTTP Authorization header for Basic vs Bearer schemes.
🎯 Interview Key Takeaway
Basic Auth sends Base64-encoded username:password on every request; Bearer Auth sends security tokens (JWT) instead of passwords.
#Basic Auth#Bearer Token#HTTP Headers#Beginner
Back to all Authentication & Authorization Questions→