title: HTTP Basic Auth, reading password file and performance
body: <p>I'm curious to know what are the performance impacts of using HTTP Basic Auth on a webserver like Apache or lighttpd or nginx. I imagine the bottleneck is the actual reading of the file by the server to authenticate a user. It also seems to me that the cost of reading the file to authenticate a user is proportional to the number of users in that file.</p>
  
  <p>Questions i have are:<br>
  1. is there a specific number of users at which basic auth via file starts to fall dramatically or is it linearly relative to the number of users in the file?<br>
  2. Given the stateless nature of http, if a user has been authenticated using HTTP Basic Auth by the webserver on one request:<br>
  - does it simply forward the credentials on every request and the webserver must parse the password file everytime in order to determine if this is a request from a valid user?<br>
  or<br>
  - get something like a token that it uses in the http header on subsequent requests, allowing the server to avoid parsing the password file again? </p>
  
  <p>thanks in advance</p>