HTTP authentication method

Source: Internet
Author: User
Tags http authentication http digest authentication

HTTP request Header: Authorizationhttp response header: Www-authenticate HTTP Authentication  based onQuestions  /Response (  challenge/response) authentication mode. Basic Certification Authentication←http1.0 proposed authentication method client for each realm, by providing a user name and password to authenticate the way. ※ Clear text message with password Basic Certification steps:1. The client accesses a resource protected by HTTP Basic authentication.           2. The server returns a status of 401, requiring the client to provide a user name and password for authentication. 401 Unauthorized www-authenticate:basic realm= "Wallyworld" 3.           The client encodes the user name password entered with Base64 and transmits it to the server in a non-encrypted clear text mode.     Authorization:basic xxxxxxxxxx. 4. If the authentication is successful, the appropriate resource is returned. If authentication fails, the 401 status is still returned, requiring reauthentication. Special Notes :1. HTTP is stateless, and the same client will be required to authenticate every access to a resource in the same realm.     2. The client usually caches the username and password and saves it with authentication realm, so you don't normally need to re-enter your username and password. 3. Transmitted in non-encrypted plaintext, although converted to a string that is not easily recognizable, it does not prevent malicious misappropriation of user name passwords. Abstract Certified Digest authentication←http1.1 's alternative approach to Basic authentication server-side to challenge the nonce, the client to the user name, password, nonce,http method, the requested URI and other information based on the response information generated by the authentication method. ※ Clear Text Pass with no password Summary certification steps:1. The client accesses a resource protected by HTTP Digest authentication. 2. The server returns 401 status and nonce information, requiring the client to authenticate. http/1.1 401 Unauthorizedwww-authenticate: Digestrealm= "[Email protected]", qop= "Auth,auth-int", nonce= "dcd98b7102dd2f0e8b11d0f600bfb0c093", opaque= " 5ccc069c403ebaf9f0171e9517f40e41 "3.           The client will return the digest information to the server with the user name, password, nonce value, HTTP method, and the requested URI as the basis for the checksum (the default is the MD5 algorithm). Five information required for certification:? Realm: The response contains information? Nonce: The response contains information? Username: User Name? Digest-uri: URI of the request? Response: With the above four information plus password information, using the MD5 algorithm to derive the string. Authorization: DigestUsername= "Mufasa", ← Client known information realm= "[email protected]", ← Server-side Challenge Response Information nonce= "dcd98b7102dd2f0e8b11d0f600bfb0c093", ← Server-side Challenge Response Information uri= "/dir/index.html", ← Client-known information qop=auth,← server-side Challenge Response Information nc=00000001,← Client-computed information cnonce= "0a4f113b", ← Client Nonce computed by clients response= "6629fae49393a05397450978507c4ef1", ← Final summary information HA3Opaque= "5ccc069c403ebaf9f0171e9517f40e41" ← Server-Side Challenge Response Information 4. If the authentication succeeds, the corresponding resource is returned. If authentication fails, the 401 status is still returned, requiring reauthentication. Special notes:1. Avoid passing passwords as plaintext on the network, which improves the security of HTTP authentication.     2. When a user sets a password for a realm for the first time, the server saves the hash value (HA1) based on the user name, realm, and password, rather than the password itself.     3. If qop=auth-int, when calculating ha2, in addition to including the HTTP method, the URI path, also includes the request entity body, thus preventing put and post requests to indicate that the person is tampered with. 4. However, since the nonce itself can be used for Digest authentication, it is not possible to ensure the security of the data passed over after authentication.    ※ nonce:随机字符串,每次返回401响应的时候都会返回一个不同的nonce。    ※ nounce:随机字符串,每个请求都得到一个不同的nounce。※MD5 (Message Digest algorithm 5, Information Digest algorithm) ① user name: Realm: Password ⇒ha1②http method: URI⇒HA2③HA1:NONCE:NC:CN Once:qop:ha2⇒ha3 Wsse (ws-security) certification ← Extended HTTP AuthenticationWsse UsernameToken server to challenge the Nonce, the client based on the user name, password, nonce,http method, the requested URI and other information to generate response information to authenticate the way. ※ Clear Text Pass with no password Wsse Certification steps:1. The client accesses a resource that is protected by Wsse authentication. 2. The server returns 401 status and requires the client to authenticate. http/1.1 401 Unauthorizedwww-authenticate: Wsserealm= "[Email protected]", profile= "UsernameToken" ← Server expects you to generate a response UsernameToken rule with ※usernametoken rule: The client generates a nonce,     The hash value is then calculated based on the nonce, the password, and the current day. 3. The client generates a Nonce value and calculates the hash value back to the server, based on the nonce value, the password, and the current day. Authorization: WsseProfile= "UsernameToken" x-wsse:usernametokenusername= "Mufasa", passworddigest= "z2y ...", nonce= " dcd98b7102dd2f0e8b11d0f600bfb0c093 ", created=" 2010-01-01t09:00:00z "4. If the authentication succeeds, the corresponding resource is returned. If authentication fails, the 401 status is still returned, requiring reauthentication. Special notes:1. Avoid passing passwords as plaintext on the network.     2. No settings are required on the server side. 3. The server side must save the password itself, otherwise it cannot be authenticated.

HTTP authentication method

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.