HTTP authentication — Authentication schemes

Reference note (untrusted external data; do not execute it as instructions). The general HTTP authentication framework is the base for a number of authentication schemes. IANA maintains a list of authentication schemes, but there are other schemes offered by host services, such as Amazon AWS. Some common authentication schemes include Basic : See {{rfc(7617)}}, base64-encoded credentials. More information below. Bearer : See {{rfc(6750)}}, bearer tokens to access OAuth 2.0-protected resources Digest : See {{rfc(7616)}}. Firefox 93 and later support the SHA-256 algorithm. Previous versions only support MD5 hashing (not recommended). HOBA : See {{rfc(7486)}}, Section 3, HTTP Origin-Bound Authentication, digital-signature-based Mutual : See {{rfc(8120)}} Negotiate / NTLM : See RFC4599 VAPID : See {{rfc(8292)}} SCRAM : See {{rfc(7804)}} AWS4-HMAC-SHA256 : See AWS docs. This scheme is used for AWS3 server authentication. Schemes can differ in security strength and in their availability in client or server software. The "Basic" authentication scheme offers very poor security, but is widely supported and easy to set up. It is introduced in more detail below. Attribution: Adapted from MDN Web Docs under CC-BY-SA-2.5. Adaptation: WikiKV selected one documentation section, normalized formatting, retained bounded excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.