Dear members,
What is the right way to set basic Authorization in httpsClient Function Block of ArSsl library?
Thanks
Hi,
I havenât implemented a basic authorization until now, but I think it could be solved by dealing with the header parameters of AsHttps.
In detail I mean:
thereâs the possibility to attach a request header and response header structures to the service function blocks. And you have to use and to âmanipulateâ those header informations to realise basic auth.
What is basic auth:
- When using basic auth, the web client has to send in the header a variable called âAuthorizationâ with a value âBasic XXXXYYYYZZZZâ, where âXXXXYYYYZZZZâ is the Base64 coded combination of âusername:passwordâ.
- this header âlineâ has to be send by the client with every request. If the client does not send this information, the server has to refuse the connection by sending the HTTP status 401, with a additional header variable âWWW-Authenticateâ with value âBasic Realm=âAABBCCDDââ
- the realm âAABBCCDDâ means the authentication scheme ⌠itâs too much to explain it here, more or less itâs a user-defined string and you should use the same realm everywhere on your server where the same credentials should be used).
More theory about basic auth can be found in the internet
What does that mean for AsHttp(s) webservice? Unfortunately I havenât a sample for it availiable, but I try to explain how it should work (as I said, I havenât tried until now):
- use the RequestHeader and ResponseHeader datapaoints of the http(s) service function block to connect to the HTTP headers
- Set in the ResponseHeader the information for basic auth by setting one of the userLine[z].name to âWWW-Authenticateâ and .value to 'Basic Realm=âYourRealmâ â
- If a requests arrives: check if the RequestHeader contains a variable âAuthorizationâ (by setting one of the userLine[z].name variable to âAuthorizationâ)
- if no, set in the ResponseHeader the variable .status to â401â (means HTTP Unauthorized) and send a response (of course without the user data you want to send if auth was correct)
- if yes, base64 decode the value after "Basic " and check, if it contains the username and password wanted
- if credentials match, in ResponseHeader set .status to â200â (means HTTP OK)
- if credentials are not right, proceed like described above when âAuthorizationâ is not set (respond with status â401â) if you wanât the client to show again the credentials message, or with some other HTTP status like â503â (Service unavailable) if you donât want the client to proceed.
Hope that helps,
best regards!
1 Like
Well I tried, as you suggested and I was able to post the request.
It works, thanks
2 Likes