Allow Basic authentication for HTTP
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Edge\BasicAuthOverHttpEnabled
This value is a device-wide Microsoft Edge policy stored as REG_DWORD. A value of 0 disables Basic authentication over nonsecure HTTP: Microsoft Edge blocks affected authentication requests and permits Basic authentication only over HTTPS.
The setting does not block HTTP connections in general. Its scope is limited to the Basic authentication scheme.
Notes
Security
Basic authentication encodes the user name and password with Base64 but does not encrypt them. When it is used over an unprotected HTTP connection, an attacker capable of observing the network traffic can intercept and subsequently misuse the credentials.
Setting the value to 0 prevents Microsoft Edge from sending credentials through Basic authentication over such an unencrypted connection. The policy does not establish an HTTPS connection or protect other content transmitted over HTTP.
Possible side effects
Users cannot authenticate to websites, web applications, or HTTP proxies that support only Basic authentication over unencrypted HTTP. Protected resources can therefore become unavailable even though the underlying HTTP connection remains possible.
Basic authentication over HTTPS remains available unless another policy excludes it.
Notes
The policy is supported on Windows starting with Microsoft Edge 88. It is not profile-specific and supports dynamic policy refresh.
If the AuthSchemes policy is configured without Basic in its list of supported authentication schemes, Basic authentication remains completely unavailable regardless of this registry value.
Microsoft documentation
Microsoft Learn: BasicAuthOverHttpEnabled – Allow Basic authentication for HTTP
Microsoft Learn: Basic Authentication and credential protection