diff --git a/xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/XWikiAuthentication.java b/xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/XWikiAuthentication.java
index 38c5bee..c4fb279 100644
--- a/xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/XWikiAuthentication.java
+++ b/xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/XWikiAuthentication.java
@@ -21,6 +21,7 @@
 
 import java.util.logging.Level;
 
+import org.apache.commons.lang.StringUtils;
 import org.restlet.Context;
 import org.restlet.Request;
 import org.restlet.Response;
@@ -84,23 +85,13 @@ public boolean authenticate(Request request, Response response)
 
         Form headers = (Form) request.getAttributes().get(HeaderConstants.ATTRIBUTE_HEADERS);
 
-        if (headers.getValues(HeaderConstants.HEADER_AUTHORIZATION) == null) {
+        if (!hasBasicAuthHeader(headers)) {
             /*
              * If there isn't an authorization header, check if the context contains an already authenticated session.
              * If it's the case use the previously authenticated user.
              */
-            try {
-                XWikiUser xwikiUser = xwiki.getAuthService().checkAuth(xwikiContext);
-                if (xwikiUser != null) {
-                    // Make sure the user is absolute
-                    xwikiContext.setUser(xwikiUser.getUser().contains(":") ? xwikiUser.getUser() : xwikiContext
-                        .getDatabase() + ':' + xwikiUser.getUser());
-                    getLogger().log(Level.FINE, String.format("Authenticated as '%s'.", xwikiUser.getUser()));
-                }
-            } catch (XWikiException e) {
-                getLogger().log(Level.WARNING, "Exception occurred while authenticating.", e);
-            }
 
+            trySessionAuthenticate(xwiki, xwikiContext);
             /*
              * If we are here, either the xwikiContext contained good credentials for a previously authenticated user or
              * these credentials are no longer valid or an error occurred during authentication. We consider all these
@@ -117,4 +108,52 @@ public boolean authenticate(Request request, Response response)
         return super.authenticate(request, response);
     }
 
+   /**
+     * Checks if the current request has basic authentication headers, because if we call super when we have digest
+     * authentication headers, we don't even end up calling checkSecret (401 is returned by restlet before that) so we
+     * cannot control what happens if basic auth fails.
+     *
+     * @param headers the headers of the current request
+     * @return {@code true} if there are basic auth headers (at least one value of header Authorization that starts with
+     *         "Basic"), {@code false} otherwise
+     */
+    private boolean hasBasicAuthHeader(Form headers)
+    {
+        String authorizationHeaderValues = headers.getValues(HeaderConstants.HEADER_AUTHORIZATION);
+        if (!StringUtils.isEmpty(authorizationHeaderValues)) {
+            // split by comma to take all the values and find one that starts with Basic
+            for (String value : authorizationHeaderValues.split(",")) {
+                // according to http://tools.ietf.org/html/rfc1945#section-11.1 basic authentication header starts with
+                // Basic
+                if (value.trim().startsWith("Basic ")
+                    || value.trim().startsWith("Negotiate ")) {
+                    return true;
+                }
+            }
+        }
+
+      return false;
+   }
+
+    /**
+     * Tries to use the already authenticated session as the user of this request. In particular this will check if
+     * there is a cookie in the request to identify an already authenticated user.
+     *
+     * @param xwiki the XWiki current instance
+     * @param xwikiContext the XWikiContext the context of the request
+     */
+    private void trySessionAuthenticate(XWiki xwiki, XWikiContext xwikiContext)
+    {
+        try {
+            XWikiUser xwikiUser = xwiki.getAuthService().checkAuth(xwikiContext);
+            if (xwikiUser != null) {
+                // Make sure the user is absolute
+                xwikiContext.setUser(xwikiUser.getUser().contains(":") ? xwikiUser.getUser() : xwikiContext
+                    .getDatabase() + ':' + xwikiUser.getUser());
+                getLogger().log(Level.FINE, String.format("Authenticated as '%s'.", xwikiUser.getUser()));
+            }
+        } catch (XWikiException e) {
+            getLogger().log(Level.WARNING, "Exception occurred while authenticating.", e);
+        }
+    }
 }
diff --git a/xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/XWikiSecretVerifier.java b/xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/XWikiSecretVerifier.java
index de97269..bfcd472 100644
--- a/xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/XWikiSecretVerifier.java
+++ b/xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/XWikiSecretVerifier.java
@@ -29,6 +29,7 @@
 import com.xpn.xwiki.XWiki;
 import com.xpn.xwiki.XWikiContext;
 import com.xpn.xwiki.XWikiException;
+import com.xpn.xwiki.user.api.XWikiUser;
 
 /**
  * Secret verifier that authenticates the user against XWiki authentication system.
@@ -74,17 +75,51 @@ public boolean verify(String identifier, char[] secret) throws IllegalArgumentEx
 
                 xwikiContext.setUser(xwikiUser);
 
-                this.context.getLogger().log(Level.FINE, String.format("Authenticated as '%s'.", identifier));
-
-                return true;
+                this.context.getLogger().log(
+                    Level.FINE,
+                    String.format("Authenticated with basic authentication as '%s'.", identifier)
+                );
+            } else {
+                this.context.getLogger().log(
+                    Level.WARNING,
+                    String.format("Cannot authenticate with basic authentication '%s'.", identifier)
+                );
+                // if we haven't been able to authenticate anyone using the authorization headers, check if the context
+                // contains an already authenticated session. If it's the case use the previously authenticated user.
+                trySessionAuthenticate(xwiki, xwikiContext);
             }
         } catch (XWikiException e) {
-            this.context.getLogger().log(Level.WARNING, "Exception occurred while authenticating.", e);
+            this.context.getLogger().log(
+                Level.WARNING, "Exception occurred while verifying authentication.", e
+            );
         }
 
-        this.context.getLogger().log(Level.WARNING, String.format("Cannot authenticate '%s'.", identifier));
-
-        return false;
+        // this will translate into a 1 being always returned by the authenticate method above, which is ok, the user
+        // will always be guest if authentication fails. In particular this means that REST will never return 401, but
+        // always use guest to perform the action, which is not rights escalation since it would mean that guest has
+        // more rights than authenticated user, which doesn't make sense.
+        return true;
     }
 
+    /**
+     * Tries to use the already authenticated session as the user of this request. In particular this will check if
+     * there is a cookie in the request to identify an already authenticated user.
+     * 
+     * @param xwiki the XWiki current instance
+     * @param xwikiContext the XWikiContext the context of the request
+     */
+    private void trySessionAuthenticate(XWiki xwiki, XWikiContext xwikiContext)
+    {
+        try {
+            XWikiUser xwikiUser = xwiki.getAuthService().checkAuth(xwikiContext);
+            if (xwikiUser != null) {
+                // Make sure the user is absolute
+                xwikiContext.setUser(xwikiUser.getUser().contains(":") ? xwikiUser.getUser() : xwikiContext
+                    .getDatabase() + ':' + xwikiUser.getUser());
+                this.context.getLogger().log(Level.FINE, String.format("Authenticated as '%s'.", xwikiUser.getUser()));
+            }
+        } catch (XWikiException e) {
+            this.context.getLogger().log(Level.WARNING, "Exception occurred while authenticating.", e);
+        }
+    }
 }
