HTTP keeps nothing between requests, so a server that wants to know who is asking must be told on every request. Basic authentication, defined in RFC 7617 , does it the simplest way: every request carries the username and password in a header. The simulator shows each message whole, so you can read the password …

A session moves the password off the wire. The browser sends it once, in a login form; the server then creates a record, "this random id belongs to alice", and hands the id back in a cookie. The browser returns the cookie on every request, and the server looks the id up to learn who is asking. The simulator shows each …

TLS protects a password on its way to a server, and that raises one question: how does a browser know it is talking to shop.example and not to someone standing in its place? Only the server has to answer it, because the browser is the one about to hand over a secret. The simulator plays out the answer with six parties: …

TLS is what turns the password of Basic HTTP Authentication from readable text into ciphertext. Before any HTTP is sent, the client and the server agree on a secret that nobody on the path can compute, and the server proves that it holds the private key of a certificate issued for the name the client typed. The …