服务器是怎么要求客户端强行弹出身份验证窗口的

王朝java/jsp·作者佚名  2006-01-09
窄屏简体版  字體: |||超大  

我们访问tomcat服务器的时候如果试图访问Tomcat Manager就会发现浏览器弹出一个登陆对话框,和我们平常的网页对话框不同,而且查看页面的时候查不到生成这个对话框的代码,禁止脚本也毫无作用。手头的资料对这个东西没有任何介绍,它到底是怎么弹出来的呢?

用jmeter创建一个http request的sampler,再建一个view result tree的lisenter来看看服务器返回了些什么污七八糟的:

HTTP response headers:

HTTP/1.1 401 Unauthorized

Pragma: No-cache

Cache-Control: no-cache

Expires: Thu, 01 Jan 1970 08:00:00 CST

WWW-Authenticate: Basic realm="Tomcat Manager Application"

Content-Type: text/html;charset=utf-8

Content-Length: 954

Date: Thu, 30 Jun 2005 09:27:26 GMT

Server: Apache-Coyote/1.1

嘿嘿,原来是一个带WWW-Authenticate的401错误啊。自己写个jsp模拟一下看看怎么样:

<%

response.addHeader("WWW-Authenticate","Basic realm=\"Tomcat Manager Application\"");

response.sendError(401,"Unauthorized");

%>

果然,一个一模一样的登陆窗口跳出来了。不过身份验证的具体过程要怎么做呢?google了一下,果然看到好东西了: http://www.chinadata.cn/showContent.asp?projectID=2083

按照说明构造了一个jsp文件:

<%

sun.misc.BASE64Decoder decoder = new sun.misc.BASE64Decoder();

boolean authenticated = false;

String authorization = request.getHeader("authorization");

System.out.println("authorization:"+authorization);

if (authorization != null)
{

if (authorization.startsWith("Basic"))
{

authorization = authorization.substring(authorization.indexOf(' ')+1);

byte[] bytes = decoder.decodeBuffer(authorization);

authorization = new String(bytes);

String userName = authorization.substring(0,authorization.indexOf(':'));

String password = authorization.substring(authorization.indexOf(':')+1);

System.out.println("userName:"+userName);

System.out.println("password:"+password);

authenticated =userName.equals("abc") && password.equals("abc");

}else if (authorization.startsWith("Digest"))
{

String userName = authorization.substring(authorization.indexOf("username="));

userName = userName.substring("username=\"".length());

userName = userName.substring(0,userName.indexOf('"'));

String password = authorization.substring(authorization.indexOf("response="));

password = password.substring("response=\"".length());

password = password.substring(0,password.indexOf('"'));

authenticated =userName.equals("abc") && password.equals("3cf1135d3b8e20dd9272d06288569a56");

}

}

if (!authenticated)
{

// response.addHeader("WWW-Authenticate","Digest realm=\"Tomcat Manager Application\"");

response.addHeader("WWW-Authenticate","Basic realm=\"Tomcat Manager Application\"");

response.sendError(401,"Unauthorized");

}else
{

out.println("hello abc");

}

%>

cool,和tomcat一模一样的登陆页面做出来了。

用户名密码均为abc,hard code在代码里面了。不过还没查到Digest方式的情况下是对哪些信息进行MD5的

 
 
 
免责声明:本文为网络用户发布,其观点仅代表作者个人观点,与本站无关,本站仅提供信息存储服务。文中陈述内容未经本站证实,其真实性、完整性、及时性本站不作任何保证或承诺,请读者仅作参考,并请自行核实相关内容。
 
 
© 2005- 王朝網路 版權所有 導航