HTTP Authentication Methods
HTTP authentication schemes: Basic, Bearer (JWT), Digest, OAuth 2.0, Mutual TLS, and modern alternatives like WebAuthn and passkeys.
HTTP authentication schemes compared with their RFC, header, security level, typical uses and notes, from Basic and Bearer tokens to OAuth 2.0, OpenID Connect, mutual TLS, API keys and WebAuthn passkeys, followed by a short list of best practices.
Use it when
- You are choosing an authentication scheme for an API or web application.
- You need the header format and security properties of each.
Watch out for
- A scheme is only as strong as its deployment: HTTPS is required for Basic and Bearer, and tokens must be stored, scoped and revoked properly.
- OAuth 2.0 is an authorization framework; authentication needs OpenID Connect or another layer.
The data
Schemes
8 rows
| Name | Rfc | Header | Security | Use cases | Notes |
|---|---|---|---|---|---|
| Basic Authentication | RFC 7617 | Authorization: Basic base64(username:password) | Low (credentials sent with every request, base64 is encoding not encryption) |
| Always use HTTPS; consider rotating credentials; prefer token-based auth for production |
| Bearer Token (JWT) | RFC 6750, RFC 7519 | Authorization: Bearer <jwt_token> | Medium (stateless, self-contained, but token theft = full access) |
| Use short-lived access tokens (15min) + refresh tokens; store in httpOnly cookies for web; never in localStorage for XSS-prone apps |
| Digest Authentication | RFC 7616 | Authorization: Digest username="user", realm="...", nonce="...", uri="...", response="..." | Medium (password not sent in clear, but vulnerable to MITM without HTTPS) |
| Rarely used in modern web apps; OAuth 2.0 / JWT preferred |
| OAuth 2.0 | RFC 6749, RFC 6750 | Authorization: Bearer <access_token> | High (when implemented correctly with PKCE, short-lived tokens, secure storage) |
| Use OAuth 2.1 (draft): enforces PKCE, removes implicit flow, requires refresh token rotation |
| OAuth 2.0 + OpenID Connect | OpenID Connect Core 1.0 | Authorization: Bearer <id_token + access_token> | High (adds identity layer on top of OAuth 2.0) |
| ID token (JWT) contains user identity claims; access token for API access |
| Mutual TLS (mTLS) | RFC 8705 | Client certificate in TLS handshake | Very High (certificate-based,双向认证) |
| Server validates client certificate; often combined with OAuth 2.0 (OAuth 2.0 mTLS sender-constrained tokens) |
| API Keys | N/A (convention) | X-API-Key: <key> OR Authorization: ApiKey <key> | Low-Medium (no standardization, key theft = full access, no expiry by default) |
| Not an authentication scheme per se; use for identification, not authentication; rotate keys; set expiry |
| WebAuthn / Passkeys | W3C WebAuthn Level 3, FIDO2 | Public key credential assertion in JSON (not HTTP header based) | Very High (phishing-resistant, hardware-backed, no shared secrets) |
| Uses public key cryptography; server stores public key, client holds private key; supported by all major browsers |
Best practices
- Always use HTTPS (TLS 1.2+)
- Use short-lived access tokens (15-60 min) with refresh token rotation
- Store tokens in httpOnly, Secure, SameSite cookies for web apps (not localStorage)
- Implement token revocation (blacklist or short TTL)
- Use PKCE for public clients (SPAs, mobile apps)
- Validate token audience (aud claim) and issuer (iss claim)
- Implement rate limiting per authenticated identity
- Log authentication events for anomaly detection
Fields
The shape of this dataset, read from the data itself: every column, its type and a real value. Agents can use this to plan a query without fetching the whole document.
| Section | Field | Type | Example |
|---|---|---|---|
| schemes | name | string | Basic Authentication |
| schemes | rfc | string | RFC 7617 |
| schemes | header | string | Authorization: Basic base64(username:password) |
| schemes | security | string | Low (credentials sent with every request, base6… |
| schemes | use_cases | array | [3 items] |
| schemes | notes | string | Always use HTTPS; consider rotating credentials… |
| best_practices | * | array | [8 items] |
Fetch the same bytes
The static files contain the same reference rows as the API, with no API rate limit. Live metadata, such as view counts, may differ. Use the API for content negotiation; use the static files for a cacheable snapshot.
curl "https://yjtoon.yunusemrevurgun.com/api/dataset/http-authentication-methods?format=toon"
const res = await fetch( "https://yjtoon.yunusemrevurgun.com/static-data/dataset/http-authentication-methods.toon" ); const toon = await res.text();
Rate limit: 120 requests per minute per IP, no key and no signup. API reference →