java http 摘要认证_Tomcat - 设置 HTTP 摘要认证

在 Tomcat 中设置 HTTP 摘要认证的示例

在 Tomcat 中设置摘要认证与设置基本认证几乎一样，差别在于配置 web.xml 时， 元素在指定认证方法时，基本认证设置 auth-method 为 BASIC，而摘要认证设置 auth-method 为 DIGEST：

DIGEST

hueyhome

测试：

a) 无认证信息请求

C:\Users\huey> curl -I http://localhost:8080/helloweb/home/index.html

HTTP/1.1 401 Unauthorized

Server: Apache-Coyote/1.1

Pragma: No-cache

Cache-Control: no-cache

Expires: Thu, 01 Jan 1970 08:00:00 CST

WWW-Authenticate: Digest realm="hueyhome", qop="auth", nonce="1463129892972:deeaa87bec6be4057899dac852625e9c", opaque="AECB8C2E17E7F66CF7905F638B7463EA"

Content-Type: text/html;charset=utf-8

Content-Length: 951

Date: Fri, 13 May 2016 08:58:12 GMT

b) 正确认证信息且该用户无指定资源的访问权限

C:\Users\huey>curl -I --digest -u "all:all" http://localhost:8080/helloweb/home/index.html

HTTP/1.1 401 Unauthorized

Server: Apache-Coyote/1.1

Pragma: No-cache

Cache-Control: no-cache

Expires: Thu, 01 Jan 1970 08:00:00 CST

WWW-Authenticate: Digest realm="hueyhome", qop="auth", nonce="1463130123893:17b1a3bc2383eb5742e8d34e036fe75d", opaque="AECB8C2E17E7F66CF7905F638B7463EA"

Content-Type: text/html;charset=utf-8

Content-Length: 951

Date: Fri, 13 May 2016 09:02:03 GMT

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Pragma: No-cache

Cache-Control: no-cache

Expires: Thu, 01 Jan 1970 08:00:00 CST

Accept-Ranges: bytes

ETag: W/"250-1463128711512"

Last-Modified: Fri, 13 May 2016 08:38:31 GMT

Content-Type: text/html

Content-Length: 250

Date: Fri, 13 May 2016 09:02:04 GMT