[quoted text, click to view]

There is no single way of doing this. The HTTP specification permits the
server to send back supported authN mechanisms via the use of
WWW-Authenticate: headers (e.g.

WWW-Authenticate: Basic

(to show that the server supports Basic Authentication). The client would
send credentials back using an Authorization: header

But it's also possible to send credentials via a HTTP form (e.g. ASP.NET
forms based authentication or similar). In this case access is anonymous at
the HTTP layer, but authentication occurs within the application layer.
Alternatively you can use client certificates to authenticate users - in
this case authentication data is sent as part of the SSL/TLS handshake that
occurs even before HTTP headers are exchanged (i.e. below the HTTP layer).

So there are many ways to authenticate clients to the server. The KB article
is talking about HTTP-based authentication.

Cheers
Ken