simulating a login

[Roedy Green]

When you access a protected directory on an HTTP server, you are asked
for a username and password in your browser.

Where is that protocol documented so that you could simulate it in a
Java client?

What logs you out?

 

[Marko Lahma]

Where is that protocol documented so that you could simulate it in a

Java client?

What logs you out?

I now assume that you mean the HTTP BASIC type of authentication. This
document has quite nice and short explanation (and refers to RCF):
http://builder.com.com/5100-6370-1049444.html . I'm not sure whether
user can affect the logout sequence, it might just be timeout.

-Marko

 

[Christophe Vanfleteren]

When you access a protected directory on an HTTP server, you are asked
for a username and password in your browser.

Where is that protocol documented so that you could simulate it in a
Java client?

What logs you out?

When using BASIC authentication, your browser sends the base64 encoded
password/username with every request. So the only way to log out, is to
stop sending it with the http-headers.

 

[Roedy Green]

I now assume that you mean the HTTP BASIC type of authentication. This
document has quite nice and short explanation (and refers to RCF):
http://builder.com.com/5100-6370-1049444.html . I'm not sure whether
user can affect the logout sequence, it might just be timeout.

Wow, is that ever simple!!

I'd guess you can even embed the userid/pw in the URL and send it on
every time.

 

[Roedy Green]

I now assume that you mean the HTTP BASIC type of authentication. This
document has quite nice and short explanation (and refers to RCF):
http://builder.com.com/5100-6370-1049444.html . I'm not sure whether
user can affect the logout sequence, it might just be timeout.

I think this is all you need for a basic login:

String stringUserIdPassword = userid + "," + password;

byte[] byteUserIdPassword = stringUserIdPassword.getBytes( "ASCII" );

String base64UserIdPassword = new com.mindprod.base64.Base64().encode
( byteUserIdPassword );

urlc.setRequestProperty( "Authorization:" , " Basic " +
base64UserIdPassword );

urlc.connect();

 

[Roedy Green]

I think this is all you need for a basic login:

I was wrong. This does work however:

String stringUserIdPassword = userid + ":" + password;

byte[] byteUserIdPassword = stringUserIdPassword.getBytes( "ASCII" );

String base64UserIdPassword = new Base64().encode ( byteUserIdPassword
);

urlc.setRequestProperty( "Authorization" , "Basic " +
base64UserIdPassword );

urlc.connect();



The userid and password are separated by a colon, not a comma.
There is no colon after Authorization. setRequest property inserts it
for you. There is no space before "Basic". setRequest property
inserts it for you.

 

[Roedy Green]

Where is that protocol documented so that you could simulate it in a
Java client?

I have discovered a method called

PasswordAuthentication
java.net.Authenticator.requestPasswordAuthentication(
InetAddress addr,
int port,
String protocol,
String prompt,
String scheme)

That looks as if it automatically handles inserting authentication in
subsequent GET requests. What would you put in the "scheme"
parameter?

 

[Sajjad Lateef]

I have discovered a method called

PasswordAuthentication
java.net.Authenticator.requestPasswordAuthentication(
InetAddress addr,
int port,
String protocol,
String prompt,
String scheme)

That looks as if it automatically handles inserting authentication in
subsequent GET requests. What would you put in the "scheme"
parameter?

I guess scheme would be "http" (But, not 100% sure.)

See:
http://www.ietf.org/rfc/rfc1738.txt
and
http://www.ietf.org/rfc/rfc2396.txt

 

[Roedy Green]

I guess scheme would be "http" (But, not 100% sure.)

there must be some subtle difference between scheme and protocol or
they would not have had two parameters.

 

[Sajjad Lateef]

there must be some subtle difference between scheme and protocol or
they would not have had two parameters.

You know, I was thinking the same thing. Hence, the dodgy answer.

Let's see ...
How would a "ftp://wuarchive.wustl.edu/pub" URL be deconstructed?
Obviously, per the RFC, the scheme would be "ftp". But, is
the protocol still "HTTP"?

If only the src had the author's email address! You could just
email him the question. You could try using (e-mail address removed)
(substitute appropriately).

 

[Harald Hein]

You know, I was thinking the same thing. Hence, the dodgy answer.

The parameter is for the AUTHENTICATION scheme (basic), not the URI
scheme.

 

[Roedy Green]

The parameter is for the AUTHENTICATION scheme (basic), not the URI
scheme.

Is there any documentation on just what you can put in that parameter?