> HTTP Basic Authentication (RFC 7617): how it works, why it sets no cookie, and what GDPR and consent rules apply to password-protected pages. > > Canonical: https://www.flowconsent.com/en/services/security/basic Security # HTTP Basic Authentication Essential · [Official website](https://datatracker.ietf.org/doc/html/rfc7617) HTTP Basic Authentication is the access control scheme defined by the IETF in RFC 7617 (2015). The web server answers with a WWW-Authenticate: Basic header and the browser displays a native login box, then sends the username and password Base64-encoded in every request. It sets no cookie and loads no third-party resource, so it does not require consent, but it must only be used over HTTPS because the credentials are not encrypted. [Block HTTP Basic Authentication until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=security) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Security](https://www.flowconsent.com/en/services/security) - Consent Essential - Prior consent Not required - Documented cookies 0 - Servers Not applicable (handled by the website's own web server) Overview ## What does HTTP Basic Authentication do? ## **What is HTTP Basic Authentication?** HTTP Basic Authentication is the simplest access control mechanism built into the HTTP protocol. It is specified by the IETF in RFC 7617, published in September 2015 by Julian Reschke, which replaced the older definition in RFC 2617. It is not a product or a vendor service: every major web server (Apache, Nginx, IIS, Caddy) and most frameworks support it natively. It is commonly used to protect staging sites, admin areas, internal tools and APIs. ## **How Basic Authentication appears on a website** When a visitor requests a protected page, the server responds with a 401 status and a WWW-Authenticate: Basic header, often with a realm name. Technology scanners detect the scheme from this header. The browser then shows its own login dialog. The username and password are joined with a colon, encoded in Base64 and sent in the Authorization header of each following request. No JavaScript is loaded and no external domain is contacted. ## **Cookies and personal data** Basic Authentication does not use cookies. The browser keeps the credentials in memory for the session and resends them automatically, which is also why there is no real logout function. The personal data involved are the username, the password and the visitor's IP address, which usually ends up in the server access logs. Base64 is an encoding, not encryption: anyone who intercepts an unencrypted request can read the password. ## **GDPR and consent** No consent is required. The mechanism only serves to give an authorised user access to a service he or she requested, which falls under the strictly necessary exemption of Article 5(3) of the ePrivacy Directive. Processing of the credentials and logs is based on the contract with the user or on the site owner's legitimate interest in securing access. No data is sent to a third party or outside the EU by the scheme itself. The GDPR security obligation (Article 32) still applies. ## **Practical steps** - Serve protected areas only over HTTPS, never plain HTTP. - Store passwords hashed on the server (bcrypt or Argon2 in htpasswd files). - Limit the retention of access logs and mention them in your privacy notice. - Prefer a session-based login or an identity provider for public user accounts, and keep Basic Authentication for internal or temporary access. - Add rate limiting or IP restrictions to slow down password guessing. Compliance ## HTTP Basic Authentication and the GDPR - Legal basis Performance of a contract or legitimate interest (Art. 6(1)(b) or 6(1)(f) GDPR); storage of credentials in the browser is exempt from consent as strictly necessary (Art. 5(3) ePrivacy Directive) - Risk level low - Applicable regulations GDPR, ePrivacy Directive ### Impact assessment (DPIA) A DPIA is not required for Basic Authentication itself: it processes only login credentials and connection logs for a limited group of authorised users. Points to watch are transport security (HTTPS is mandatory because Base64 offers no protection), password storage on the server and the retention period of access logs. ### Sample text for your banner > This area is password-protected using standard HTTP authentication. Your browser sends your login details with each request so you stay signed in; no cookie is stored and nothing is shared with third parties. Cookies and trackers ## What HTTP Basic Authentication sets and contacts - Tracking method Server-side HTTP authentication scheme, detected through a WWW-Authenticate: Basic response header (usually with a 401 status). No script, no cookie. - Server location Not applicable (handled by the website's own web server) - Cookieless mode available Yes Questions ## Frequently asked questions about HTTP Basic Authentication Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does HTTP Basic Authentication set cookies? No. The browser keeps the credentials in memory and resends them in the Authorization header of each request. Nothing is written to a cookie or to local storage. ### Do I need a cookie banner for a page protected by Basic Authentication? No. The mechanism is strictly necessary to give an authorised user access to the service he or she requested, so it is exempt from consent. You should still mention the processing of login data and logs in your privacy notice. ### Is Basic Authentication secure? Only over HTTPS. The username and password are Base64-encoded, which anyone can decode, so on plain HTTP they travel in clear text. With TLS, rate limiting and strong hashed passwords it is acceptable for internal tools and staging sites. ### Why can't users log out of a Basic Authentication area? The browser caches the credentials for the session and the protocol has no logout command. Users usually have to close the browser, which is one reason to prefer session-based logins for public accounts. ### Which standard defines HTTP Basic Authentication? RFC 7617, published by the IETF in September 2015. It obsoletes the Basic part of RFC 2617 and adds a charset parameter so that servers can announce UTF-8 credentials. Related guide ## Our guides on HTTP Basic Authentication [28 March 2026](https://www.flowconsent.com/en/blog/consent-mode-basic-vs-advanced-which-to-choose) ### [Consent Mode v2: basic vs advanced mode, which one to choose?](https://www.flowconsent.com/en/blog/consent-mode-basic-vs-advanced-which-to-choose) [Consent Mode v2 offers two modes: basic (strict blocking) and advanced (anonymized pings). Differences, GDPR implications and choosing guide.](https://www.flowconsent.com/en/blog/consent-mode-basic-vs-advanced-which-to-choose) [Read the guide](https://www.flowconsent.com/en/blog/consent-mode-basic-vs-advanced-which-to-choose) Same category ## More services: Security [See the whole category](https://www.flowconsent.com/en/services/security) ### [ClickGuard](https://www.flowconsent.com/en/services/security/clickguard) [ClickGUARD is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. ClickGUARD enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, ClickGUARD empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/security/clickguard) [Marketing](https://www.flowconsent.com/en/services/security/clickguard) · ### [Skyflow](https://www.flowconsent.com/en/services/security/skyflow) [Skyflow is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Skyflow supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Skyflow ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/skyflow) [Essential](https://www.flowconsent.com/en/services/security/skyflow) · ### [AWS Certificate Manager](https://www.flowconsent.com/en/services/security/aws-certificate-manager) [AWS Certificate Manager is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. AWS Certificate Manager supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, AWS Certificate Manager ensures your website delivers a smooth, uninterrupted experience to every visitor and.](https://www.flowconsent.com/en/services/security/aws-certificate-manager) [Security](https://www.flowconsent.com/en/services/security/aws-certificate-manager) · ### [MaxMind](https://www.flowconsent.com/en/services/security/maxmind) [MaxMind is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. MaxMind supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, MaxMind ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/maxmind) [Essential](https://www.flowconsent.com/en/services/security/maxmind) · ### [OpenSSL](https://www.flowconsent.com/en/services/security/openssl) [OpenSSL is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. OpenSSL integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, OpenSSL helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/security/openssl) [Security](https://www.flowconsent.com/en/services/security/openssl) · ### [ARCaptcha](https://www.flowconsent.com/en/services/security/arcaptcha) [ARCaptcha is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. ARCaptcha integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, ARCaptcha helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/security/arcaptcha) [Essential](https://www.flowconsent.com/en/services/security/arcaptcha) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)