Question

I am wondering what is the purpose of encoding the String: "login:password" in base 64 when using HTTP Basic Auth.

• Base 64 is usually used to send binary data through ASCII only protocols. But the login:password is already a String
• It adds practically no security
• The output is longer than the input, so it does not improve performances

I am probably missing something since it does currently seems to me that this encoding just adds an unneeded layer of complexity.

Thank you

Answer 1

From http://en.wikipedia.org/wiki/Basic_access_authentication

Security is not the intent of the
encoding step. Rather, the intent of
the encoding is to encode
non-HTTP-compatible characters that
may be in the user name or password
into those that are HTTP-compatible.