A few notes:

– it only uses HTTP headers
– it does not encrypt the username:password, it only base64 encodes them to obtain a string (think about a password containig two newlines 🙂 )
– so it is highly recommended to be used over HTTPS
– if this is not possible, then HTTP digest authentication should be used instead
– initially, the server responds with a HTTP 401 Non Authorized response code
– the HTTP headers must be sent by the browser with every subsequent request, so caching is necessary
– the web server does not provide a ‘log out’ mechanism; each browser has its own way of logging out. Example for Chrome: load http://username@mysite.com

More details on the Wikipedia page: http://en.wikipedia.org/wiki/Basic_access_authentication
HTTP Digest Access Authentication: http://en.wikipedia.org/wiki/Digest_access_authentication
How to set up HTTP Basic Authentication in Apache: http://wiki.apache.org/httpd/PasswordBasicAuth

Photo: iStockPhoto