2

The HttpUnit API for webclient says that "Will only send the authorization header when challenged for the specified realm." What does challenged mean in this case? How does HttpUnit recognize a challenge?

rest_day
  • 858
  • 2
  • 13
  • 28

2 Answers2

3

This refers to the way HTTP Authentication works:

When accessing a protected URL (for the first time, with no credentials included in the request), the server will send back a response that has a status code of 401 Unauthorized and a WWW-Authenticate header set to something like Basic realm="My Realm". This indicates that Basic authentication is needed for the given URL and the realm is named 'My Realm'. This is the challenge - the user agent is being informed by the server that the URL it tried to access requires authentication and it should send back the user credentials. The user agent will typically prompt the user for credentials and then retry the request, this time with a Authorization header set to something like Basic rXflcjMwYXxz where the second part is the Base64 encoded username and password pair.

In case of the HttpUnit method you've linked to, you'll see that it requires a realm, username and password. I imagine that when the a URL is accessed, if it gets back a 401 (the challenge) from the server, it'll compare the realm you passed it with the realm in the response; if it matches, it'll attempt to authenticate with the username and password supplied.

References:

no.good.at.coding
  • 20,221
  • 2
  • 60
  • 51
2

When the server responds with a 401 error, the HttpUnit throws an AuthorizationRequiredException. We can use getParameter("realm") of the exception to get the realm and send a request again with this realm name.

rest_day
  • 858
  • 2
  • 13
  • 28
  • I'm a little confused - this doesn't seem to answer your own question *What does challenged mean in this case? How does HttpUnit recognize a challenge?*. This seems to be the answer to something like *How might get the realm name with HTTPUnit?* I thought my post answered your original question. – no.good.at.coding May 18 '11 at 22:27
  • Sure, your post answered the question and I have upvoted the question. Guess, what I was trying to say is that you can use this method to identify a challenge from a 401 response and get the required info. – rest_day May 19 '11 at 23:02