Name Basic

Honesty Boundary

The toy auth challenge keeps its boundary narrow.

highlighted = computed this step

What this toy model checks

The trust boundary parses one GET request with no Authorization header and one challenge response.

recompute auth challenge rows\text{recompute auth challenge rows}
Challenge honesty boundaryThe Basic challenge scheme, realm, and empty response body are recomputed from pinned bytes.Challenge honesty boundary - GET /private has no Authorization; response 401 Unauthorized names Basicsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/privateparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorizationabsentabsentstatusversionHTTP/1.1parsedstatusstatus401 UnauthorizedchallengeheaderWWW-AuthenticateBasic realm toysafe display formheaderContent-Length0empty bodybodybyte length0countedchallengeschemeBasicparsedchallengerealm displaytoyparsedcheckAuthorization headerabsentmissingcheckstatus401 Unauthorizedchallengecheckchallenge schemeBasicBasiccheckrealmtoytoychecksent body bytes0empty

Honesty boundary

NOTE: toy HTTP auth challenge only; not browser credential prompts, password managers, TLS, password storage, sessions, cookies, OAuth, bearer tokens, multiple challenges, proxy auth, realms beyond the pinned label, HTTP/2 or HTTP/3, frameworks, or production auth config.

toy auth challenge only\text{toy auth challenge only}
Challenge honesty boundaryThe Basic challenge scheme, realm, and empty response body are recomputed from pinned bytes.Challenge honesty boundary - GET /private has no Authorization; response 401 Unauthorized names Basicsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/privateparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorizationabsentabsentstatusversionHTTP/1.1parsedstatusstatus401 UnauthorizedchallengeheaderWWW-AuthenticateBasic realm toysafe display formheaderContent-Length0empty bodybodybyte length0countedchallengeschemeBasicparsedchallengerealm displaytoyparsedcheckAuthorization headerabsentmissingcheckstatus401 Unauthorizedchallengecheckchallenge schemeBasicBasiccheckrealmtoytoychecksent body bytes0empty

No client compute

The page shows already validated rows. It does not run browser auth handling.

static validated rows\text{static validated rows}
Challenge honesty boundaryThe Basic challenge scheme, realm, and empty response body are recomputed from pinned bytes.Challenge honesty boundary - GET /private has no Authorization; response 401 Unauthorized names Basicsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/privateparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorizationabsentabsentstatusversionHTTP/1.1parsedstatusstatus401 UnauthorizedchallengeheaderWWW-AuthenticateBasic realm toysafe display formheaderContent-Length0empty bodybodybyte length0countedchallengeschemeBasicparsedchallengerealm displaytoyparsedcheckAuthorization headerabsentmissingcheckstatus401 Unauthorizedchallengecheckchallenge schemeBasicBasiccheckrealmtoytoychecksent body bytes0empty

Summary

A challenge response names Basic and a realm when credentials are missing.

challenge complete\text{challenge complete}
Challenge honesty boundaryThe Basic challenge scheme, realm, and empty response body are recomputed from pinned bytes.Challenge honesty boundary - GET /private has no Authorization; response 401 Unauthorized names Basicsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/privateparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorizationabsentabsentstatusversionHTTP/1.1parsedstatusstatus401 UnauthorizedchallengeheaderWWW-AuthenticateBasic realm toysafe display formheaderContent-Length0empty bodybodybyte length0countedchallengeschemeBasicparsedchallengerealm displaytoyparsedcheckAuthorization headerabsentmissingcheckstatus401 Unauthorizedchallengecheckchallenge schemeBasicBasiccheckrealmtoytoychecksent body bytes0empty