1. Web Server Design Week 10 Old Dominion University
Department of Computer Science
CS 495/595 Spring 2012
Michael L. Nelson
03/13/12

2. Authentication: Basic & Digest
Defined in RFC-2617
Basic
very simple
sends password in the clear (very bad)
suitable for personalization; not real security
Digest
uses cryptographic hashes; password not sent in the clear
stronger than Basic, but client support not as prevalent
does not encrypt content…
SSL, SHTTP or equivalent needed for that
Extensible: other authentication mechanisms defined elsewhere
e.g.: OAuth, RFC-5849

3. Authentication Structure
Both methods are structurally similar:
when the server receives a request for a protected resource, it responds with:
status code “401 Unauthorized”
“WWW-Authenticate:” response header
the client reissues the same request with the addition of:
“Authorization:” request header

4. Basic “WWW-Authenticate:” response header:
WWW-Authenticate: Basic realm=”ODU-CS-595-S06"
auth type
opaque string to differentiate auth files
“Authorization:” request header:
Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
auth type
Base64(username:password)

5. Scenario client server scenario 2: the client could have sent the
GET foo HTTP/1.1
client
server
401 Unauthorized
WWW-Authenticate: Basic realm=“xyz”
GET foo HTTP/1.1
Authorization: Basic mln:gohokies!
200 OK
scenario 2: the client could have sent the
Authorization string with the initial request
mln:gohokies! would be base64’d

6. How Apache Does It… (Note: our syntax will be different!)
In either <Directory> entries in the config file, or “.htaccess” files in directories:
AuthType Basic
AuthName "Restricted Files"
AuthUserFile /usr/local/apache/passwd/passwords
Require user rbowen
Many more options possible:

7. Apache Example
antares:/home/mln/public_html/teaching/cs595-s12/restrict % htpasswd -c ./passwd mln
New password:
Re-type new password:
Adding password for user mln
antares:/home/mln/public_html/teaching/cs595-s12/restrict % ls
encode.pl* foo.txt passwd
antares:/home/mln/public_html/teaching/cs595-s12/restrict % more passwd
mln:Ggkaf46I4CTRI
antares:/home/mln/public_html/teaching/cs595-s12/restrict % ls -al
total 48
drwxr-xr-x 2 mln faculty :32 ./
drwxr-xr-x 14 mln faculty :48 ../
-rw-r--r-- 1 mln faculty :32 .htaccess
-rwxr-xr-x 1 mln faculty :02 encode.pl*
-rw-r--r-- 1 mln faculty :02 foo.txt
-rw-r--r-- 1 mln faculty :32 passwd
note: having your password file acccessible by the web
server is generally not a good idea…

8. Apache Example (2)
antares:/home/mln/public_html/teaching/cs595-s12/restrict % more .htaccess
AuthType Basic
AuthName "This is What the RFC Calls a Domain"
AuthUserFile /home/mln/public_html/teaching/cs595-s12/restrict/passwd
Require user mln
antares:/home/mln/public_html/teaching/cs595-s12/restrict % more encode.pl
#!/usr/bin/perl
use MIME::Base64;
$string = encode_base64("mln:mln");
print "$string\n";
antares:/home/mln/public_html/teaching/cs595-s12/restrict % ./encode.pl
bWxuOm1sbg==
antares:/home/mln/public_html/teaching/cs595-s12/restrict %

9. Original Request % telnet www.cs.odu.edu 80 Trying 128.82.4.2...
Connected to xenon.cs.odu.edu.
Escape character is '^]'.
HEAD /~mln/teaching/cs595-s12/restrict/ HTTP/1.1
Host:
HTTP/ Authorization Required
Date: Mon, 12 Mar :40:55 GMT
Server: Apache/ (Unix) PHP/5.3.5 mod_ssl/ OpenSSL/0.9.8q
WWW-Authenticate: Basic realm="This is What the RFC Calls a Domain"
Content-Type: text/html; charset=iso
Connection to xenon.cs.odu.edu closed by foreign host.

10. Second Request % telnet www.cs.odu.edu 80 Trying 128.82.4.2...
Connected to xenon.cs.odu.edu.
Escape character is '^]'.
HEAD /~mln/teaching/cs595-s12/restrict/ HTTP/1.1
Host:
Authorization: Basic bWxuOm1sbg==
HTTP/ OK
Date: Mon, 12 Mar :42:49 GMT
Server: Apache/ (Unix) PHP/5.3.5 mod_ssl/ OpenSSL/0.9.8q
Content-Type: text/html;charset=ISO
Connection to xenon.cs.odu.edu closed by foreign host.

11. Wrong user:pw == 401 % telnet www.cs.odu.edu 80 Trying 128.82.4.2...
Connected to xenon.cs.odu.edu.
Escape character is '^]'.
HEAD /~mln/teaching/cs595-s12/restrict/ HTTP/1.1
Host:
Authorization: Basic bWxuOm1alsdkfsldjslkdjfl==
HTTP/ Authorization Required
Date: Mon, 12 Mar :46:05 GMT
Server: Apache/ (Unix) PHP/5.3.5 mod_ssl/ OpenSSL/0.9.8q
WWW-Authenticate: Basic realm="This is What the RFC Calls a Domain"
Content-Type: text/html; charset=iso
Connection to xenon.cs.odu.edu closed by foreign host.

12. 401 Trumps 404 et al. why? % telnet www.cs.odu.edu 80
Trying
Connected to xenon.cs.odu.edu.
Escape character is '^]'.
HEAD /~mln/teaching/cs595-s12/restrict/THISDIRDOESNOTEXIST/ HTTP/1.1
Host:
Authorization: Basic bWxuOm1alsdkfsldjslkdjfl==
HTTP/ Authorization Required
Date: Mon, 12 Mar :53:51 GMT
Server: Apache/ (Unix) PHP/5.3.5 mod_ssl/ OpenSSL/0.9.8q
WWW-Authenticate: Basic realm="This is What the RFC Calls a Domain"
Content-Type: text/html; charset=iso
Connection to xenon.cs.odu.edu closed by foreign host.
why?

13. Why Not a “403 Forbidden” ? 10.4.4 403 Forbidden
The server understood the request, but is refusing to fulfill it.
Authorization will not help and the request SHOULD NOT be repeated.
If the request method was not HEAD and the server wishes to make
public why the request has not been fulfilled, it SHOULD describe the
reason for the refusal in the entity. If the server does not wish to
make this information available to the client, the status code 404
(Not Found) can be used instead.

14. 403 Reminder % touch bar.txt % chmod 000 bar.txt
% telnet 80
Trying
Connected to xenon.cs.odu.edu.
Escape character is '^]'.
HEAD /~mln/teaching/cs595-s12/restrict/bar.txt HTTP/1.1
Host:
Authorization: Basic bWxuOm1sbg==
HTTP/ Forbidden
Date: Mon, 12 Mar :56:15 GMT
Server: Apache/ (Unix) PHP/5.3.5 mod_ssl/ OpenSSL/0.9.8q
Content-Type: text/html; charset=iso
Connection to xenon.cs.odu.edu closed by foreign host.