> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/web-application-and-api-protection-waap/application-security-testing/advanced-usage/authentication/basic-auth.md).

# Basic Auth

Basic Authentication (Basic Auth) is a simple and commonly used method for securing web resources and APIs. The client authenticates by sending a username and password in the HTTP request header. These credentials are base64-encoded before transmission.

### Configurations

Basic Auth mechanism has the following configurations:

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>Configuration</td><td>Description</td></tr><tr><td><strong>Username</strong></td><td>The username of the user or the application.</td></tr><tr><td><strong>Password</strong></td><td>The password for the user or application.</td></tr><tr><td><strong>Header Value Template</strong> (Optional)</td><td><p>Basic Authentication works by directly encoding the <code>username:password</code> pair into a <em>base64</em> string and replacing it in the <code>Authorization</code> header, <code>{{value}}</code> placeholder:</p><pre><code>Authorization: Basic {{value}}
</code></pre></td></tr></tbody></table>

***

## Example

The following are some samples that you can use to configure the *Basic Auth* mechanism in the Advanced mode:

### Sample 1

```language-python
import base64

def basic_auth_hook(scanctx: ScanContext, pluginctx: PluginContext, testcase: TestCase, **kwargs) -> list[Assertion]:
    attributes = testcase.get_attributes()
    username = "TOKEN_VALUE
    password = "TOKEN_VALUE"
    # set user
    normal_user = True
    bola_user = False
    # Encode the credentials in Base64
    auth_string = base64.b64encode(f"{username}:{password}".encode()).decode()
    header_value = "Basic %s" % auth_string
    attributes.set("mutated.auth.attribute", "mutated.http.request.header.authorization")
    attributes.delete("mutated\\.http\\.request\\.cookie", regex=True)
    attributes.delete("mutated.http.request.header.cookie")


    #attributes.set("mutated.role.user", username)
    attributes.set("mutated.http.request.header.authorization", header_value)
    return []
```

### Sample 2

```language-python
import base64

def basic_auth_hook(scanctx: ScanContext, pluginctx: PluginContext, testcase: TestCase, **kwargs) -> list[Assertion]:
    attributes = testcase.get_attributes()
    username = "TOKEN_VALUE"
    password = "TOKEN_VALUE"
    logger.info("Invoked zendesk custom auth for url" + attributes.get_one("mutated.http.request.url", "") + " and plugin " + pluginctx.get_plugin())
    header_value_format = "Basic {{value}}"
    # set user
    normal_user = True
    bola_user = False
    # Encode the credentials in Base64
    auth_string = base64.b64encode(f"{username}:{password}".encode()).decode()
    header_value = header_value_format.replace("{{value}}", str(auth_string))
    attributes.set("mutated.auth.attribute", "mutated.http.request.header.Authorization")

    if normal_user:
        attributes.set("mutated.role.user", header_value)
        attributes.set("mutated.http.request.header.Authorization", header_value)
    if bola_user:
        attributes.set("mutated.role.bolauser", header_value)
    return []
```