Authentication

What is authentication?

Authentication is the process of checking that a person or service is who it claims to be. For example, when a learner signs in to TaruByte, the system checks proof such as a username and password before treating the request as coming from that learner.

In simple words, authentication answers: “Who are you?”

Basic authentication

Basic authentication is a simple HTTP authentication scheme. The client sends a username and password in an Authorization request header. It joins them with a colon and encodes that text with Base64.

Authorization: Basic <Base64-encoded username:password>

Base64 is only an encoding; it is easy to reverse, so it does not hide the credentials. Use HTTPS to encrypt the connection while the request travels to the server. Basic authentication answers who is making this request? The server still decides what that user is allowed to do.

The scheme is defined in IETF RFC 7617.

Digest authentication

What is a digest?

A digest is a fixed-size value produced by applying a hash function to some input. It is like a digital fingerprint: the same input produces the same digest, while a small change to the input usually produces a very different one. A digest is not encrypted data; there is no decryption step that turns it back into the original input. However, someone can still try guesses, especially when the original input is weak.

How Digest authentication uses it

The server sends the client a challenge that includes a server-provided value called a nonce. The client calculates a response using password-related information, the challenge, and details of the request. It sends that digest response to the server, which checks it. The password itself is not sent directly in the request.

Server sends challenge → Client calculates digest response → Server verifies response

HTTP Digest authentication is specified in IETF RFC 7616.