api: YAML JSON TOON Database
version: 1.0.0
format: toon
dataset:
  id: 2806
  slug: http-authentication-methods
  title: HTTP Authentication Methods
  description: "HTTP authentication schemes: Basic, Bearer (JWT), Digest, OAuth 2.0, Mutual TLS, and modern alternatives like WebAuthn and passkeys."
  summary: "HTTP authentication schemes compared with their RFC, header, security level, typical uses and notes, from Basic and Bearer tokens to OAuth 2.0, OpenID Connect, mutual TLS, API keys and WebAuthn passkeys, followed by a short list of best practices."
  use_when[2]: You are choosing an authentication scheme for an API or web application.,You need the header format and security properties of each.
  caveats[2]: "A scheme is only as strong as its deployment: HTTPS is required for Basic and Bearer, and tokens must be stored, scoped and revoked properly.",OAuth 2.0 is an authorization framework; authentication needs OpenID Connect or another layer.
  related[4]: authentication-factors,http-client-error-guide,http-request-headers,common-vulnerabilities-owasp
  entry_count: 16
  fields[7]{section,field,type,example}:
    schemes,name,string,Basic Authentication
    schemes,rfc,string,RFC 7617
    schemes,header,string,"Authorization: Basic base64(username:password)"
    schemes,security,string,"Low (credentials sent with every request, base6…"
    schemes,use_cases,array,"[3 items]"
    schemes,notes,string,Always use HTTPS; consider rotating credentials…
    best_practices,*,array,"[8 items]"
  category: HTTP Status Codes
  category_slug: http-status-codes
  tags: "http,authentication,basic,bearer,jwt,oauth2,digest,webauthn,passkeys"
  view_count: 37
  created_at: 1778695229
  updated_at: 1778695229
data:
  schemes[8]:
    - name: Basic Authentication
      rfc: RFC 7617
      header: "Authorization: Basic base64(username:password)"
      security: "Low (credentials sent with every request, base64 is encoding not encryption)"
      use_cases[3]: Simple internal tools,Development/testing,Service-to-service with HTTPS only
      notes: Always use HTTPS; consider rotating credentials; prefer token-based auth for production
    - name: Bearer Token (JWT)
      rfc: "RFC 6750, RFC 7519"
      header: "Authorization: Bearer <jwt_token>"
      security: "Medium (stateless, self-contained, but token theft = full access)"
      use_cases[4]: SPA + API,Mobile apps,Microservices,Third-party integrations
      notes: Use short-lived access tokens (15min) + refresh tokens; store in httpOnly cookies for web; never in localStorage for XSS-prone apps
    - name: Digest Authentication
      rfc: RFC 7616
      header: "Authorization: Digest username=\"user\", realm=\"...\", nonce=\"...\", uri=\"...\", response=\"...\""
      security: "Medium (password not sent in clear, but vulnerable to MITM without HTTPS)"
      use_cases[4]: Legacy systems,WebDAV,IP cameras,Embedded devices
      notes: Rarely used in modern web apps; OAuth 2.0 / JWT preferred
    - name: OAuth 2.0
      rfc: "RFC 6749, RFC 6750"
      header: "Authorization: Bearer <access_token>"
      security: "High (when implemented correctly with PKCE, short-lived tokens, secure storage)"
      use_cases[4]: Third-party authorization,SSO,API delegation,Mobile/web app auth
      notes: "Use OAuth 2.1 (draft): enforces PKCE, removes implicit flow, requires refresh token rotation"
    - name: OAuth 2.0 + OpenID Connect
      rfc: OpenID Connect Core 1.0
      header: "Authorization: Bearer <id_token + access_token>"
      security: High (adds identity layer on top of OAuth 2.0)
      use_cases[3]: User authentication (not just authorization),SSO across domains,Social login
      notes: ID token (JWT) contains user identity claims; access token for API access
    - name: Mutual TLS (mTLS)
      rfc: RFC 8705
      header: Client certificate in TLS handshake
      security: "Very High (certificate-based,双向认证)"
      use_cases[4]: Service-to-service (zero-trust),High-security APIs,Financial APIs,B2B integrations
      notes: Server validates client certificate; often combined with OAuth 2.0 (OAuth 2.0 mTLS sender-constrained tokens)
    - name: API Keys
      rfc: N/A (convention)
      header: "X-API-Key: <key> OR Authorization: ApiKey <key>"
      security: "Low-Medium (no standardization, key theft = full access, no expiry by default)"
      use_cases[4]: Developer API access,Rate limiting by key,Simple service access,Analytics/tracking
      notes: "Not an authentication scheme per se; use for identification, not authentication; rotate keys; set expiry"
    - name: WebAuthn / Passkeys
      rfc: "W3C WebAuthn Level 3, FIDO2"
      header: Public key credential assertion in JSON (not HTTP header based)
      security: "Very High (phishing-resistant, hardware-backed, no shared secrets)"
      use_cases[4]: Passwordless login,MFA second factor,Mobile app authentication,Enterprise SSO
      notes: "Uses public key cryptography; server stores public key, client holds private key; supported by all major browsers"
  best_practices[8]: Always use HTTPS (TLS 1.2+),Use short-lived access tokens (15-60 min) with refresh token rotation,"Store tokens in httpOnly, Secure, SameSite cookies for web apps (not localStorage)",Implement token revocation (blacklist or short TTL),"Use PKCE for public clients (SPAs, mobile apps)",Validate token audience (aud claim) and issuer (iss claim),Implement rate limiting per authenticated identity,Log authentication events for anomaly detection