Over-ride Browser Authentication Dialog

Question

Is there a way using Java to over-ride the browser authentication dialog box when a 401 message is received from the web server? I want to know when this dialog is being displayed, and instead of it being given to the user, I fill in the credentials for them.

Overview of application:

i wrote the web server, so essentially i want to stop someone from opening an external browser and putting in the localhost and port to gain access to the data being displayed. my app has an embedded web browser linked to my written server. the browser displays decrypted content, so if i force the auth (even for my embedded browser), an external browser would need credentials. if my embedded browser is trying to access the files, i supply the credentials for the user and display the content

Answer 1

SWT 3.5M6 has a new listener within it call AuthenticationListener. It simply listens for authentication event passed from the server and is fired. The code below is what performs the behavior I wanted. It waits for the auth, and if the host is my application, it passes back the credentials. Of course fill in the USER_NAME, PASSWORD and HOST_NAME with appropriate variables. Otherwise it lets the browser auth dialog pop up and makes the user enter the credentials. This code can also be found in the Eclipse SWT snippets page:

webBrowser.addAuthenticationListener(new AuthenticationListener()

{

        public void authenticate(AuthenticationEvent event) {
            try {
                URL url = new URL(event.location);

                if (url.getHost().equals(HOST_NAME)) 
                {
                    event.user = USER_NAME;
                    event.password = PASSWORD;
                } 
                else 
                {       
                    /* do nothing, let default prompter run */
                }
            } catch (MalformedURLException e) {
                /* should not happen, let default prompter run */
            }
        }
    });

Answer 2

If you don't care about the password showing you can construct the URL so it passes the credentials ex. http://username:password@www.example.com This will by pass the authentication box but will show the user the credentials so also might not be what you are looking for.

Answer 3

your question is a bit unclear. The whole basic authentication is based on HTTP Headers.

If the browser gets an authorization header than it displays the dialog. The content from the dialog is then send back to the server. There is nothing special about it. It iser username:password in base64 encoded. Have a look at

wikipedia

The problem is how you want to interfere. You would have to capture the authorization header and then for the next request you have to alter the HTTP header to include the credentials.

hope that helps

Answer 4

I think this is mostly browser-dependent behavior and what the server reports to the browser.

For example, Internet Explorer, being a Microsoft product, directly supports automatic sending of Windows credentials (you can modify this behavior in your Internet Settings) after an anonymous request fails in a 401.

Firefox, for example, does not and will always prompt the user even if it was set to remember the id and password via the password manager. IE will also prompt if auto-login fails (such as your Windows credentials still result in a 401 because you're id isn't allowed).

I don't think, as a web developer, you have much control over this besides setting up your server and app to work in the most expected and harmonious way... if you could, this might get into black hat territory.

Answer 5

If you want to control what is displayed to the user for authentication, you can change the auth-method in the login-config section of the web.xml from BASIC to FORM.

Then you can specify what page should be displayed when the user is authenticating, and, I suppose, pre-fill the credentials for them...but doesn't this defeat the whole purpose of security?

Setting up Authentication for Web Applications

Edit after further details:

My only suggestion would be to change the auth-method to CLIENT-CERT and require two-way SSL, where the client is also required to present a certificate to the server. If you install the certificate into your embedded browser (and make sure external browsers can't get the certificate) then you should be OK. And actually this should stop any authentication dialog from being displayed.