0

I need to include some secure (BASIC authentication) application.

when I open the application URL in the browser, the browser asks me to enter your credentials ...

what I know is that:

  1. The browser ask the server to get some URL -- the url of the app
  2. The server checks the request header for the Authentication header and didn't find it
  3. The server sends 401 to the browser back
  4. The browser interpret this response code into a message dialog that shows to me asking me to enter the username/password to send back to the server in the Authentication request header

So far... so good, I can write some page (in JSP) that send this required http request header to the request that is calling this page.. So I'll call this application through my page..

The problem here is, this application (in fact a GWT application) contains a reference to some Javascript and CSS files that is coming from the server that hosts this application. the application page that I import looks like:

<html>
    <link href="http://application_host/cssfile.css" />
    <link href="http://application_host/javascriptfile.js" />
    .....
</html>

So, again I found the application asks me for the authentication crenditals for the css and js files!

I am thinking of many solutions but don't know the applicability of each

  • One solution is to ask the browser (via Javascript) to send the request header (Authentication) when he asks the server for the js and css files

please give me your opinions about that... and any other suggestions will be very welcomed.

Thanks.

4

3 回答 3

1

我认为您对服务器的配置方式有些奇怪。身份验证发生在身份验证领域的上下文中。您的资产应该与您的页面位于相同的身份验证领域，或者（更有可能）根本不需要身份验证。浏览器应该缓存给定领域的凭据，而不是再次提示它们。

请参阅http://en.wikipedia.org/wiki/Basic_access_authentication上的协议示例

于 2011-02-11T20:59:59.293 回答
0

Why css & js files are kept in protected area of server? You need to place files into public area of your server. If you don't have public area, so you nead to prpvide for it. how to do it depends from serverside software architecture & configuration.

于 2011-02-11T21:25:41.450 回答
0

从您的故事来看，有些事情告诉我您的问题在于身份验证方法 itef。不是如何实现它。为什么要这么费心处理请求头？

据我所知，您可以配置您的容器（即 Tomcat）以强制对某些 url 进行 http 身份验证。您的容器将确保已进行身份验证。无需自己设置 http 标头。

也许您可以更好地解释您要实现的目标，而不是告诉实现细节？

于 2011-02-11T20:55:17.963 回答