HTTP basic authentication in Web Applications

[mini mehta]

What is the HTTP basic authentication in Web Applications? How does this works and how is it administered?

[James Swan]

Basic Authentication is a process where the HTTP response sent back to the http user agent contains the following info:
WWW-Authenticate BASIC realm="myRealm"
When the user agent (your browser) receives this it pops up a dialog box prompting for a username and password for "myRealm"
The user agent sends back the request with a header that looks like this:
Authorization BASIC Base64Encoded(username :password)
So long as the username and password is fine the user is allowed through to the protected resource.
How Basic Authentication is set up really depends on which HTTP server you are running.
Some HTTP servers have a file called .htaccess in the directory which you want to protect, containing the list of authorized users.
Basic Authentication is good in that it is relatively easy to setup, and you just let the browser and HTTP server handle the authentication, but a major problem is there is no "logout" functionality.
The only way to logout is for the user to close their browser.
Anyway, here is some code to simulate Basic Authentication, and will let you see what is going on, you can added code to print out the headers and see what is being sent back and forth between the client and server.

import java.io.*;
import java.util.*;
import javax.servlet.*;
import javax.servlet.http.*;
public class BasicAuthentication extends HttpServlet { 
    Hashtable validUsers = new Hashtable();
    public void init(ServletConfig config) throws ServletException {
        super.init(config);
        // ie this user has no password
        validUsers.put("james:","authorized");
         
        validUsers.put("jswan:mypassword","authorized");
    }
    public void doGet(HttpServletRequest req, HttpServletResponse res)
                    throws ServletException, IOException {
        
        res.setContentType("text/html");
        PrintWriter out = res.getWriter();
        // Get Authorization header
        String auth = req.getHeader("Authorization");
        // Do we allow that user?
        if (!allowUser(auth)) {
            // Not allowed, so report he's unauthorized
            res.setHeader("WWW-Authenticate", "BASIC realm=\"jswan test\"");
            res.sendError(res.SC_UNAUTHORIZED);
            // Could offer to add him to the allowed user list
        } else {
            // Allowed, so show him the secret stuff
            out.println("Top-secret stuff");
        }
    }
    // This method checks the user information sent in the Authorization
    // header against the database of users maintained in the users Hashtable.
    protected boolean allowUser(String auth) throws IOException {
        
        if (auth == null) {
            return false;  // no auth
        }
        if (!auth.toUpperCase().startsWith("BASIC ")) { 
            return false;  // we only do BASIC
        }
        // Get encoded user and password, comes after "BASIC "
        String userpassEncoded = auth.substring(6);
        // Decode it, using any base 64 decoder
        sun.misc.BASE64Decoder dec = new sun.misc.BASE64Decoder();
        String userpassDecoded = new String(dec.decodeBuffer(userpassEncoded));
    
        // Check our user list to see if that user and password are "allowed"
        if ("authorized".equals(validUsers.get(userpassDecoded))) {
            return true;
        } else {
            return false;
        }
    }
}

Also check out the manuals for your HTTP serverm I am sure they will have extensive detail on how to setup Basic Authentication.
James.

[This message has been edited by james swan (edited August 23, 2001).]