By my reading, the spec is not that clear about it. It does say that A user agent that wishes to authenticate itself with an origin server--usually, but not ne

By my reading, the spec is not that clear about it. It does say that A user agent that wishes to authenticate itself with an origin server--usually, but not necessarily, after receiving a 401 (Unauthorized) -- implying, imo, that no prior 401 response is needed. On the other hand, the spec also says A client SHOULD assume that all paths at or deeper than the depth of the last symbolic element in the path field of the Request-URI also are within the protection space specified by the Basic realm value of the current challenge. A client MAY preemptively send the corresponding Authorization header with requests for resources in that space without receipt of another challenge from the server. which would imply that at least one 401 response should be received before sending credentials. Of course the most important part of the spec is this: The Basic authentication scheme is not a secure method of user authentication, nor does it in any way protect the entity, which is transmitted in cleartext across the physical network used as the carrier.