diff --git a/actix-web-httpauth/CHANGES.md b/actix-web-httpauth/CHANGES.md
index 1b72cee94..cd3f20e04 100644
--- a/actix-web-httpauth/CHANGES.md
+++ b/actix-web-httpauth/CHANGES.md
@@ -1,6 +1,10 @@
 # Changes
 
 ## Unreleased - 2022-xx-xx
+- `BasicAuth::user_id()` now returns a `&str`. [#249]
+- `BasicAuth::password()` now returns a `&str`. [#249]
+
+[#249]: https://github.com/actix/actix-extras/pull/249
 
 
 ## 0.7.0 - 2022-07-19
diff --git a/actix-web-httpauth/src/extractors/basic.rs b/actix-web-httpauth/src/extractors/basic.rs
index 817cc5175..bad0df878 100644
--- a/actix-web-httpauth/src/extractors/basic.rs
+++ b/actix-web-httpauth/src/extractors/basic.rs
@@ -93,13 +93,13 @@ pub struct BasicAuth(Basic);
 
 impl BasicAuth {
     /// Returns client's user-ID.
-    pub fn user_id(&self) -> &Cow<'static, str> {
-        self.0.user_id()
+    pub fn user_id(&self) -> &str {
+        self.0.user_id().as_ref()
     }
 
     /// Returns client's password.
-    pub fn password(&self) -> Option<&Cow<'static, str>> {
-        self.0.password()
+    pub fn password(&self) -> Option<&str> {
+        self.0.password().map(|s| s.as_ref())
     }
 }