在MSNP8之前,帐户验证是采取的MD5加密后直接传送。然而到MSNP9之后,帐户验证改为更加安全的SSL。
下面直接介绍帐户验证的全过程:
第一步,与nexus.passport.com:443的交互。
客户端连接 nexus.passport.com:443 (Passport Nexus)
客户端发送>>> GET /rdr/pprdr.asp HTTP/1.0/r/n/r/n
服务器回应<<< HTTP/1.1 200 OK/r/n
Server: Microsoft-IIS/5.0/r/n
Date: Wed, 01 Sep 2004 01:04:01 GMT/r/n
PPServer: H: BAYPPNEX2A01/r/n
Connection: close/r/n
PassportURLs: DARealm=Passport.Net,DALogin=loginnet.passport.com/login2.srf,DAReg=http://register.passport.net/uixpwiz.srf,Properties=https://register.passport.net/editprof.srf,Privacy=http://www.passport.com/consumer/privacypolicy.asp,GeneralRedir=http://nexusrdr.passport.com/redir.asp,Help=http://memberservices.passport.net/memberservice.srf,ConfigVersion=12/r/n
Content-Length: 0/r/n
Content-Type: text/html/r/n
Cache-control: private/r/n
/r/n
客户端关闭连接 nexus.passport.com
没什么好说得,我们需要关心的就是DALogin=loginnet.passport.com/login2.srf,这就是我们第二步需要打交道地址。
第二步,与loginnet.passport.com:443的交互。
客户端连接 loginnet.passport.com:443 (Passport Login)
客户端发送>>> GET /login2.srf HTTP/1.1/r/n
客户端发送>>> Authorization: Passport1.4 OrgVerb=GET,OrgURL=http%3A%2F%2Fmessenger%2Emsn%2Ecom,sign-in=example%40passport.com,pwd=password,lc=1033,id=507,tw=40,fs=1,ru=http%3A%2F%2Fmessenger%2Emsn%2Ecom,ct=1062764229,kpp=1,kv=5,ver=2.1.0173.1,tpf=43f8a4c8ed940c04e3740be46c4d1619/r/n
客户端发送>>> Host: loginnet.passport.com/r/n
这里要提醒的是Authorization串的构成为:
Authorization: Passport1.4 OrgVerb=GET,OrgURL=http%3A%2F%2Fmessenger%2Emsn%2Ecom,sign-in=用户帐户,pwd=用户密码,Challenge串/r/n
用户帐户和用户密码不需要解释了,但是需要注意的是@符号必须换为%40,也就是替换为URL串。
Challenge串,就是NS服务器在TWN S给出的Challenge串。
接下来服务器回应,正常情况可以获得如下回应
服务器回应<<< HTTP/1.1 200 OK/r/n
Connection: close/r/n
Date: Wed, 01 Sep 2004 01:09:42 GMT/r/n
Server: Microsoft-IIS/6.0/r/n
PPServer: H: BAYPPLOGN2B22/r/n
Content-Type: text/html/r/n
Expires: Wed, 01 Sep 2004 01:08:42 GMT/r/n
Cache-Control: no-cache/r/n
cachecontrol: no-store/r/n
Pragma: no-cache/r/n
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"/r/n
Set-Cookie: MSPSec1= ; expires=Thu, 30-Oct-1980 16:00:00 GMT;domain=.passport.com;path=/;HTTPOnly= ;version=1/r/n
Set-Cookie: MSPSec=6orWjrUokE3i3XG3GGC9tP4KftG!3kUnY2QmTW8ppByVMm1egjI0!260jRwxGSm!Wr; HTTPOnly= ; domain=.passport.com;path=/;secure=/r/n
Set-Cookie: MSPAuth=6wUK!5557DsjoJzrD15JNrGLa4VMWbI1rGsOXq!R9or2q2colCh3kuqQKTVFQdtsAWz*!bumZJDdCBaePFACH14w$$; HTTPOnly= ; domain=.passport.com;path=//r/n
Set-Cookie: MSPProf=6Upjs3HLAA4!heb0iHk!fCP0h5szP8PzqqL9aj3aisFSWVHSpMubFMvArm!t3mqvke4rHkds9kPa*anw93KknJjXiEvBPlLqd0cxLh!8gifNvfPVEDKig4GKi44RECDubf; HTTPOnly= ; domain=.passport.com;path=//r/n
Set-Cookie: MSPPre=example@hotmail.com; HTTPOnly= ; domain=.passport.com;path=/;Expires=Wed, 30-Dec-2037 16:00:00 GMT/r/n
Set-Cookie: MSPShared= ; HTTPOnly= ; domain=.passport.com;path=/;Expires=Thu, 30-Oct-1980 16:00:00 GMT/r/n
Authentication-Info: Passport1.4 da-status=success,tname=MSPAuth,tname=MSPProf,tname=MSPSec,from-PP='t=5ocbEBb0XDSDMY64A2Noph10Nph6RP1NUJNWyotSSCCeRYWtqURtjnWgDrDiBKjm5OxNiJpr0Y3E8kyZ0nE1zY!A$$&p=5hEUIS67wG1DcCFYrcdUiE21rFLPVQSA1N!C84nRDSoIwB*w7sIUZgvLTPz60BPoBNMYzeVIlcwrY5!VySn8QyijXOtTPCvy3DdkIxsRTgQzb4qSHjoXotYyN70xAUMIfvQq0Tv!ndoy0K4i2jiSrnfNQMisoYqXjFmUEHcnDScjNFdOpKubLAiQ$$',ru=http://messenger.msn.com/r/n
t=5ocbEBb0XDSDMY64A2Noph10Nph6RP1NUJNWyotSSCCeRYWtqURtjnWgDrDiBKjm5OxNiJpr0Y3E8kyZ0nE1zY!A$$&p=5hEUIS67wG1DcCFYrcdUiE21rFLPVQSA1N!C84nRDSoIwB*w7sIUZgvLTPz60BPoBNMYzeVIlcwrY5!VySn8QyijXOtTPCvy3DdkIxsRTgQzb4qSHjoXotYyN70xAUMIfvQq0Tv!ndoy0K4i2jiSrnfNQMisoYqXjFmUEHcnDScjNFdOpKubLAiQ$$
Content-Length: 0/r/n/r/n
我们关系的关键部分在“Authentication-Info:”,其中参数from-PP,就是我们所需要的“入场券”
在此例中是t=5ocbEBb0XDSDMY64A2Noph10Nph6RP1NUJNWyotSSCCeRYWtqURtjnWgDrDiBKjm5OxNiJpr0Y3E8kyZ0nE1zY!A$$&p=5hEUIS67wG1DcCFYrcdUiE21rFLPVQSA1N!C84nRDSoIwB*w7sIUZgvLTPz60BPoBNMYzeVIlcwrY5!VySn8QyijXOtTPCvy3DdkIxsRTgQzb4qSHjoXotYyN70xAUMIfvQq0Tv!ndoy0K4i2jiSrnfNQMisoYqXjFmUEHcnDScjNFdOpKubLAiQ$$
如果认证失败,将得到如下回应
服务器回应<<< HTTP/1.1 401 Unauthorized/r/n
Connection: close/r/n
Date: Wed, 01 Sep 2004 01:21:15 GMT/r/n
Server: Microsoft-IIS/6.0/r/n
PPServer: H: BAYPPLOGN2A24/r/n
Content-Type: text/html/r/n
Expires: Wed, 01 Sep 2004 01:20:15 GMT/r/n
Cache-Control: no-cache/r/n
cachecontrol: no-store/r/n
Pragma: no-cache/r/n
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"/r/n
PassportConfig: ConfigVersion=12/r/n
WWW-Authenticate: Passport1.4 da-status=failed-noretry,srealm=Passport.NET,ts=0,prompt,cburl=http://www.passportimages.com/XPPassportLogo.gif/r/n
Content-Length: 389/r/n/r/n
那没得说了,没有“入场券”那继续尝试新的认证吧。
注1:第一步采用的连接协议是HTTPS1.0,第二步是HTTPS1.1,不要搞错了。
注2:因为第一步的结果一直都是这个地址(到2004年9月仍然这样),所以我们也可以偷懒一下直接进行第二步。
Trackback: http://tb.blog.csdn.net/TrackBack.aspx?PostId=90814