Yes it is allowed – but note that it may cut off the ability to use proxies and sometimes http aware firewalls (they tend to inspect and rewrite headers).
What should be sent in headers?
- Request and Response Body.
- Request Authorization.
- Response Caching.
- Response Cookies.
1 Answer. They are Base-64 encoded for transport, but this provides no confidentiality. You must secure your communications with TLS if you plan to use Basic authentication.
