When a server allows access via Basic HTTP Authentication, what is the experience expected to be on the browser?
I typically just do this with curl:
curl -u myusername:mypassword http://somesite.com
And it works just fine. However, right now I don't have access to curl (long story), and I want to just do it from the web browser, if possible.
I thought the way Basic Auth was supposed to work was - I type in the url I want, the server then decides I'm not authorized, returns response code 401, and I type my username and password into a prompt. If it's correct, the page loads!
However, on somesite.com, I'm not getting an authorization prompt at all, just a page that says I'm not authorized. Did somesite not implement the Basic Auth workflow correctly, or is there something else I need to do?
To help everyone avoid confusion, I will reformulate the question in two parts.
First : "how can make an authenticated HTTP request with a browser, using BASIC auth?".
In the browser you can do a http basic auth first by waiting the prompt to come, or by editing the URL if you follow this format:
http://myusername:mypassword@somesite.com
NB: the curl command mentionned in the question is perfectly fine, if you have a command-line and curl installed. ;)
References:
Also according to the CURL manual page https://curl.haxx.se/docs/manual.html
The second and real question is "However, on somesite.com, I'm not getting an authorization prompt at all, just a page that says I'm not authorized. Did somesite not implement the Basic Auth workflow correctly, or is there something else I need to do?"
The curl documentation says the
-u
option supports many method of authentication, Basic being the default.You might have old invalid username/password cached in your browser. Try clearing them and check again.
If you are using IE and somesite.com is in your Intranet security zone, IE may be sending your windows credentials automatically.
If there are no credentials provided in the request headers, the following is the minimum response required for IE to prompt the user for credentials and resubmit the request.
WWW-Authenticate header
You may also get this if the server is sending a 401 response code but not setting the WWW-Authenticate header correctly - I should know, I've just fixed that in out own code because VB apps weren't popping up the authentication prompt.
You can use Postman a plugin for chrome. It gives the ability to choose the authentication type you need for each of the requests. In that menu you can configure user and password. Postman will automatically translate the config to a authentication header that will be sent with your request.
Have you tried ?