JSP强制浏览器弹出身份验证窗口

最新推荐文章于 2023-08-28 12:27:01 发布

weixin_33681778

最新推荐文章于 2023-08-28 12:27:01 发布

阅读量156

点赞数

原文链接：https://my.oschina.net/jsan/blog/104539

版权

为什么80%的码农都做不了架构师？>>>

我们访问tomcat服务器的时候如果试图访问Tomcat Manager就会发现浏览器弹出一个登陆对话框，和我们平常的网页对话框不同，用jmeter创建一个http request的sampler，再建一个view result tree的lisenter来看看服务器返回了些什么污七八糟的：

HTTP response headers:
HTTP/1.1 401 Unauthorized
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 08:00:00 CST
WWW-Authenticate: Basic realm="Tomcat Manager Application"
Content-Type: text/html;charset=utf-8
Content-Length: 954
Date: Thu, 30 Jun 2005 09:27:26 GMT
Server: Apache-Coyote/1.1

嘿嘿，原来是一个带WWW-Authenticate的401错误啊。自己写个JSP模拟一下看看怎么样：
<%
response.addHeader("WWW-Authenticate","Basic realm=\"Tomcat Manager Application\"");
response.sendError(401,"Unauthorized");
%>

果然，一个一模一样的登陆窗口跳出来了。不过身份验证的具体过程要怎么做呢？

<%
sun.misc.BASE64Decoder decoder = new sun.misc.BASE64Decoder();
boolean authenticated = false;
String authorization = request.getHeader("authorization");
System.out.println("authorization:" authorization);
if (authorization != null) {
 if (authorization.startsWith("Basic")){
	 authorization = authorization.substring(authorization.indexOf(' ') 1);
	 byte[] bytes = decoder.decodeBuffer(authorization);
	 authorization = new String(bytes);
	 String userName = authorization.substring(0,authorization.indexOf(':'));
	 String password = authorization.substring(authorization.indexOf(':') 1);
	 System.out.println("userName:" userName);
	 System.out.println("password:" password);
	 authenticated = userName.equals("abc") && password.equals("abc");
	 
 } else if (authorization.startsWith("Digest")){
	 String userName= authorization.substring(authorization.indexOf("username="));
	 userName = userName.substring("username=\"".length());
	 userName = userName.substring(0,userName.indexOf('"'));
	 String password = authorization.substring(authorization.indexOf("response="));
	 password = password.substring("response=\"".length());
	 password = password.substring(0,password.indexOf('"'));
	 authenticated =userName.equals("abc") && password.equals("3cf1135d3b8e20dd9272d06288569a56");
 }
}

if (!authenticated){
	 // response.addHeader("WWW-Authenticate","Digest realm=\"Tomcat Manager Application\"");
	 response.addHeader("WWW-Authenticate","Basic realm=\"Tomcat Manager Application\"");
	 response.sendError(401,"Unauthorized");
}else{
	out.println("hello abc");
}
%>

cool，和tomcat一模一样的登陆页面做出来了。

用户名密码均为abc，hard code在代码里面了。

另外一个资料：http://www.jspwiki.org/wiki/NTLMAuthentication

转载于:https://my.oschina.net/jsan/blog/104539