You are viewing a plain text version of this content. The canonical link for it is here.
Posted to httpclient-users@hc.apache.org by Werner <kr...@darkfluid.com> on 2010/08/08 10:30:42 UTC
Determine if authentication is needed on a site
Hello HTTPComponent Users,
I'm writing a small test-client to test the android authentication
against a Tomcat 7 Server. It uses Form-based POST authentication and
everything works, but two questions arose:
1. How can I see (from the client side), that I need to authenticate
myself to a page? The server internally redirects me to the login page
and returns a "200 OK". So the only way to find out is to analyze the
page content?
2. Do you really have to make three calls in order to get a resource
which needs authentication? Right now I am doing the following:
a) Request the resource http://localhost:8080/sample/protected/
login page is returned with a sessionId
b) Provide user credentials, call the authenticate url
http://localhost:8080/sample/protected/j_security_check
a "302 Moved Temporarily" is returned with the location header
"http://localhost:8080/sample/protected/"
a) Request the resource again http://localhost:8080/sample/protected/
finally get the desired page (but with another sessionId!)
best regards
Werner
---------------------------------------------------------------------
To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
For additional commands, e-mail: httpclient-users-help@hc.apache.org
Re: Determine if authentication is needed on a site
Posted by Oleg Kalnichevski <ol...@apache.org>.
On Mon, 2010-08-09 at 19:49 +0200, krabat@darkfluid.com wrote:
> Hi,
>
> thanks for the reply. So, since the client does not know if he should
> authenticate itself to the server and because the server is under my
> control, I transmit a custom header which shows the client that auth is
> required. Same goes for an invalid username/password if the auth fails.
> Is there another (possibly better) way to accomplish that? Is there some
> kind of best practice?
>
None I am aware of.
> Regarding the automated redirection: I read it should be enabled by
> default in HTTPComponents and I didn't configure it at all, but
> nonetheless I get a 302 returned, not the page it should redirect me to.
> Maybe it's because I reuse the httpost instance of the first request and
> just alter the URI to the login location which is provided by the action
> of the login form?
>
There are several cases when automatic redirections is prohibited by the
HTTP specification. You can provide a custom RedirectHandler (4.0) or
RedirectStrategy (4.1) implementation in order to override those
restrictions. Per default HttpClient automatically redirects 302
responses only for GET and HEAD methods.
Hope this helps
Oleg
---------------------------------------------------------------------
To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
For additional commands, e-mail: httpclient-users-help@hc.apache.org
Re: Determine if authentication is needed on a site
Posted by kr...@darkfluid.com.
Hi,
thanks for the reply. So, since the client does not know if he should
authenticate itself to the server and because the server is under my
control, I transmit a custom header which shows the client that auth is
required. Same goes for an invalid username/password if the auth fails.
Is there another (possibly better) way to accomplish that? Is there some
kind of best practice?
Regarding the automated redirection: I read it should be enabled by
default in HTTPComponents and I didn't configure it at all, but
nonetheless I get a 302 returned, not the page it should redirect me to.
Maybe it's because I reuse the httpost instance of the first request and
just alter the URI to the login location which is provided by the action
of the login form?
best regards
Werner
On 09.08.2010 14:09, Oleg Kalnichevski wrote:
> On Sun, 2010-08-08 at 10:30 +0200, Werner wrote:
>> Hello HTTPComponent Users,
>>
>> I'm writing a small test-client to test the android authentication
>> against a Tomcat 7 Server. It uses Form-based POST authentication and
>> everything works, but two questions arose:
>>
>> 1. How can I see (from the client side), that I need to authenticate
>> myself to a page? The server internally redirects me to the login page
>> and returns a "200 OK". So the only way to find out is to analyze the
>> page content?
>>
> Yes, that is the case
>
>> 2. Do you really have to make three calls in order to get a resource
>> which needs authentication? Right now I am doing the following:
>> a) Request the resource http://localhost:8080/sample/protected/
>> login page is returned with a sessionId
>> b) Provide user credentials, call the authenticate url
>> http://localhost:8080/sample/protected/j_security_check
>> a "302 Moved Temporarily" is returned with the location header
>> "http://localhost:8080/sample/protected/"
>> a) Request the resource again http://localhost:8080/sample/protected/
>> finally get the desired page (but with another sessionId!)
>>
> Usually one should get redirected to the protected resource after
> successful authentication. So, there is no need for the third step. It
> does take 3 request / response exchanges in total.
>
> Hope this helps
>
> Oleg
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
> For additional commands, e-mail: httpclient-users-help@hc.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
For additional commands, e-mail: httpclient-users-help@hc.apache.org
Re: Determine if authentication is needed on a site
Posted by Oleg Kalnichevski <ol...@apache.org>.
On Sun, 2010-08-08 at 10:30 +0200, Werner wrote:
> Hello HTTPComponent Users,
>
> I'm writing a small test-client to test the android authentication
> against a Tomcat 7 Server. It uses Form-based POST authentication and
> everything works, but two questions arose:
>
> 1. How can I see (from the client side), that I need to authenticate
> myself to a page? The server internally redirects me to the login page
> and returns a "200 OK". So the only way to find out is to analyze the
> page content?
>
Yes, that is the case
> 2. Do you really have to make three calls in order to get a resource
> which needs authentication? Right now I am doing the following:
> a) Request the resource http://localhost:8080/sample/protected/
> login page is returned with a sessionId
> b) Provide user credentials, call the authenticate url
> http://localhost:8080/sample/protected/j_security_check
> a "302 Moved Temporarily" is returned with the location header
> "http://localhost:8080/sample/protected/"
> a) Request the resource again http://localhost:8080/sample/protected/
> finally get the desired page (but with another sessionId!)
>
Usually one should get redirected to the protected resource after
successful authentication. So, there is no need for the third step. It
does take 3 request / response exchanges in total.
Hope this helps
Oleg
---------------------------------------------------------------------
To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
For additional commands, e-mail: httpclient-users-help@hc.apache.org