NOTE: These slides have not been updated since 2003. They have been superseded by the book An Introduction to XML and Web Technologies Addison-Wesley, and the accompanying online material. Please see http://www.brics.dk/ixwt/ for more information. Anders Møller and Michael Schwartzbach, February 2006

INTERACTIVE WEB SERVICES WITH JAVA

Authentication

• authentication (access restriction)
  • username/password forms (<input type="password"...>)
  • HTTP Basic Autentication
  • X.509 certificates
• encryption (confidentiality, integrity)
  • SSL - next page...

HTTP Basic Authentication:

• authentication of client (not of server)
• familiar input dialogs
• handled at protocol level, not explicitly by application
• browsers can (optionally) remember name/password (without using cookies)

How it works:

• in first interaction, the server sends an HTML error message with a HTTP header (a "challenge"):
    HTTP/1.0 401 Unauthorized
    WWW-Authenticate: Basic realm="VIP Site"
  where the realm is a sub-domain of the server

• the client responds by repeating the request, but adding another HTTP header (a "response"):
    Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
  containing the base64 encoding of "name:password"

• the server decodes the name and password, and checks with its access restrictions

• in subsequent interactions with that server, the browser can send the Authorization immediately without user involvement (convenient, but potentially dangerous)

Note: there is no encryption here!

COPYRIGHT © 2002-2003 ANDERS MØLLER & MICHAEL I. SCHWARTZBACH