struts-user mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Prashanth.S" <>
Subject Re: HTTP BASIC authentication
Date Sun, 05 Feb 2006 11:55:17 GMT
Hello laurie,
  You are right..
  Heres what i got from apache website..[see below]
  The confusion was because for some reason i was not able to see authorisation header[cached
user credentials for subsequent requests] being sent from my browser client..
  On a different note,is there any way wherein i can achieve what iam looking after??i.e establishing
"authenticated session"???
  using security filters??
  OR is it a dangerous thing to do??
  Many Thanks
  How basic authentication works
  When a particular resource has been protected using basic authentication, Apache sends a
401 Authentication Required header with the response to the request, in order to notify the
client that user credentials must be supplied in order for the resource to be returned as
  Upon receiving a 401 response header, the client's browser, if it supports basic authentication,
will ask the user to supply a username and password to be sent to the server. If you are using
a graphical browser, such as Netscape or Internet Explorer, what you will see is a box which
pops up and gives you a place to type in your username and password, to be sent back to the
server. If the username is in the approved list, and if the password supplied is correct,
the resource will be returned to the client.
  Because the HTTP protocol is stateless, each request will be treated in the same way, even
though they are from the same client. That is, every resource which is requested from the
server will have to supply authentication credentials over again in order to receive the resource.
  Fortunately, the browser takes care of the details here, so that you only have to type in
your username and password one time per browser session - that is, you might have to type
it in again the next time you open up your browser and visit the same web site.
  Along with the 401 response, certain other information will be passed back to the client.
In particular, it sends a name which is associated with the protected area of the web site.
This is called the realm, or just the authentication name. The client browser caches the username
and password that you supplied, and stores it along with the authentication realm, so that
if other resources are requested from the same realm, the same username and password can be
returned to authenticate that request without requiring the user to type them in again. This
caching is usually just for the current browser session, but some browsers allow you to store
them permanently, so that you never have to type in your password again.
  The authentication name, or realm, will appear in the pop-up box, in order to identify what
the username and password are being requested for.

Laurie Harper <> wrote:
  Prashanth.S wrote:
> Hello All,
> I have got a simple question on BASIC authentication on webresources using Tomcat.
> I had set up this BASIC authentication on tomcat and tomcat[because of my misconfiguration????]
seems to authenticate user every time they accesses resource though the client is sending
back the jsessionID cookie for session tracking...
> 2 request-response formats are as follows..Ideally i dont expect it to throw me an unauthorized
error for the 2nd request..Can anyone point out what am i doing wrong??

You're not sending the Authorization header in the second request. 
Remember, HTTP is stateless. Sessions are a web-app thing and have 
nothing to do with HTTP authentication. Sending a session cookie has no 
effect on HTTP authentication.


To unsubscribe, e-mail:
For additional commands, e-mail:

Do you Yahoo!?
 New and Improved Yahoo! Mail - 1GB free storage!
  • Unnamed multipart/alternative (inline, 8-Bit, 0 bytes)
View raw message