0

HTTP specification says;

HTTP access authentication is described in "HTTP Authentication: Basic and Digest Access Authentication" [43]. If a request is authenticated and a realm specified, the same credentials SHOULD be valid for all other requests within this realm (assuming that the authentication scheme itself does not require otherwise, such as credentials that vary according to a challenge value or using synchronized clocks).

I don't really understand what this means, but here is my scenario is there anything against HTTP specs here? I use Java Rest service

  • Client sends username:password using HTTP Authorization header using HTTP Basic
  • Server sends back a token
  • Now client sends a custom authorization token instead of password for further requests still in the HTTP authorization header still using HTTP Basic username:token

Now this does not feel right since what I am really doing with the auth token is NOT an actual HTTP Basic authorization. Also usage of the very same header is inconsistent between requests.

But on the other hand I do not want create yet another custom header for the token exchange. Because its hard to base64 encode them with test tools when you use a custom header. And still inconsistent headers between requests.

Note: these requests refers to different endpoints

What do you advice?

4

1 回答 1

0

如果您这样做，由于您使用相同的标头，您是否需要服务器端逻辑来区分登录何时是实际登录，而不是您的令牌？归根结底，HTTP 授权已经是一个令牌（只是用户名/密码字符串的简单编码版本），所以在所有情况下您都会收到一个令牌，现在您必须对其进行解码，确定它是否是您的一个会话令牌，或者如果它是用户名/密码，则检查两个“好令牌”来源。

我建议不要这样做，但不是因为你违反了标准，只是感觉很复杂。

为什么首先需要将用户名/密码更改为令牌？您是否正在重定向到不再需要 HTTP 基本身份验证的端点？

于 2013-01-03T16:14:30.467 回答