Tag
Authentication
Understand HTTP authentication challenges, credentials, authorization headers, cookies, and the status codes used in access-control flows. This curated hub brings together 15 related resources.
- Comparisons
401 vs 403: Authentication vs Authorization
Understand the difference between 401 Unauthorized and 403 Forbidden. Learn when each status code applies, common mistakes, and how to use them correctly in APIs.
- HTTP Status Codes
407 Proxy Authentication Required: Fix It
407 means your proxy wants credentials before forwarding the request. Fix it in curl, npm, pip, git and browsers, and learn how Proxy-Authenticate works.
- HTTP Headers
Authentication-Info Header
Learn how Authentication-Info provides additional authentication data in responses to successful requests. Covers digest authentication and session info.
- HTTP Headers
Authorization Header: Bearer, Basic and 401 Fixes
Authorization header carries credentials as scheme plus token. Bearer and Basic formats, WWW-Authenticate, why proxies strip it, redirects, CORS and storage.
- Comparisons
Cookie-Based vs Session-Based Authentication
Compare cookie-based and session-based authentication. Understand where state lives, security tradeoffs, scalability implications, and when to use each approach.
- Comparisons
Cookies vs localStorage vs sessionStorage: What to Use
Cookies vs localStorage vs sessionStorage: request behavior, size limits, expiry, tab scope, partitioning, XSS and CSRF risks, and auth token choices.
- Comparisons
CORS vs CSP
Understand the difference between CORS and Content Security Policy. Both are browser security mechanisms but they protect against completely different threats.
- HTTP Status Codes
HTTP 401 Unauthorized: Authentication Required
401 Unauthorized means missing or invalid credentials. Read WWW-Authenticate, check the Authorization header, token expiry and proxies, with fixes by stack.
- Guides
HTTP Authentication Methods and Best Practices
A comprehensive guide to HTTP authentication methods including Basic Auth, Bearer tokens, API keys, and OAuth 2.0.
- Guides
HTTP Sessions and State Management Explained
Learn how to manage user state and sessions in stateless HTTP applications using cookies, tokens, and server-side storage.
- Comparisons
JWT vs Session Cookies: Logout and Security
Compare stateless JWT bearer tokens with opaque session cookies: revocation, rotation, request size, browser storage, CSRF, XSS and algorithm validation.
- HTTP Headers
Proxy-Authenticate Header
Learn how the Proxy-Authenticate header challenges clients for credentials when accessing resources through a proxy. Understand proxy authentication schemes.
- HTTP Headers
Proxy-Authorization Header
Learn how Proxy-Authorization provides credentials to access resources through a proxy server. Understand proxy authentication schemes and security.
- Guides
WebSockets over HTTP: Handshakes, Proxies and Auth
Trace a WebSocket HTTP handshake, verify Sec-WebSocket-Accept, configure nginx, secure browser authentication, and debug idle disconnects and close codes.
- HTTP Headers
WWW-Authenticate
Learn how the WWW-Authenticate header specifies authentication methods required to access protected resources. Understand Basic, Bearer, and Digest schemes.