HTTP Basic Auth: colon rules, UTF-8 and HTTPS

Construct the user-pass value

Basic Auth encodes a username, one colon and the password as bytes, then Base64. The first colon is the separator.

A username cannot contain a colon; a password can. Use synthetic credentials when inspecting this format.

demo:sample-only
→ Basic ZGVtbzpzYW1wbGUtb25seQ==

Agree on character encoding

ASCII examples hide charset disagreements. RFC 7617 leaves the default encoding undefined subject to ASCII compatibility; a challenge can advertise charset UTF-8.

Nav Tools encodes text as UTF-8. For non-ASCII credentials, confirm that the receiving server expects those bytes.

WWW-Authenticate: Basic realm="demo", charset="UTF-8"

Protect the whole request path

Base64 is reversible and provides no confidentiality. HTTPS protects the transport, but application logs can still expose the Authorization value.

Use an authorized destination and avoid copying real headers into shared examples. The generator creates a header; it does not authenticate against a server.

Separate 401 from malformed bytes

First decode the synthetic header and confirm the expected username and complete password. Then check the server challenge and authentication policy.

A valid header can still receive 401 for wrong credentials or an unsupported scheme. Re-encoding a correct value will not fix that policy.