HTTP Authentication

Database Search

If you can't find the information using the categories below, post a question over in our WinBatch Tech Support Forum.

TechHome

How To

	Backups
	Ctrl Alt Del Issues
	Determine Platform - OS
	Get EXE Name
	Get Machine Name - Workstation
	Icons
	Reboot Issues
	Recycle Bin
	Resource Lock
	System Information
	User Profiles

Can't find the information you are looking for here? Then leave a message over on our WinBatch Tech Support Forum.

HTTP Authentication

Question:

Is there a way to pass the login data by calling the URL to avoid the login window at all. Is there way to pass the username/password to the web server i.e. with the .navigate command?

Answer:

There are a few methods that have been used to pass authentication.

In the original one, a small popup box appears and you enter name and password into it. If you have this kind, then you can put he userid and password on the url command line. like this: http://username:password@mydomain.com

In a newer one, in widespread use these days, simple have a simple form on a normal html screen (just like the login to our webboard). That does not use normal http authentication techniques, but rather individual methods of the web page's developers own devising.

There is a script in the tech support database that shows how to log into the WebBoard. With some modifications it can use used for many other sites...

http://techsupt.winbatch.com/webcgi/webbatch.exe?techsupt/nftechsupt.web+WinBatch/OLE~COM~ADO~CDO~ADSI~LDAP/OLE~with~MSIE+Log~onto~the~WebBoard~via~OLE.txt And finally there could even possibly be java code built into the webpage that prompts for user name and passwords.

I found a very interesting MS article that suggests you can pass the User and password as part of the OLE Navigate method. http://support.microsoft.com/?id=172998 Here is some sample code I put together based on the above article that you can try:

;----------------------------------------------------------------------------
;  B64GetCookie :  Takes no parameters.  Returns a value that must be
;                  passed to all the other B64 functions in these UDFs
;                  Basically it initializes an array for the other
;                  functions to use
;
;                  Retuns B64Cookie used by the other B64 functions.
;----------------------------------------------------------------------------
#DefineFunction B64GetCookie()
   B64Cookie=ArrDimension(256,2)  ; ,0 is to B64  ,1 if from B64
   ArrInitialize(B64Cookie,-1)
   AUPPER=Char2Num("A")
   alower=Char2Num("a")
   ZEROChr=Char2Num("0")

   For xx=0 To 25
      B64Cookie[xx,0]=Num2Char(AUPPER+xx)
      B64Cookie[xx+26,0]=Num2Char(alower+xx)
   Next

   For xx=52 To 61
      B64Cookie[xx,0]=Num2Char(ZEROChr+xx-52)
   Next

   B64Cookie[62,0]="+"
   B64Cookie[63,0]="/"

   For xx=0 To 63
       val=Char2Num(B64Cookie[xx,0])
       B64Cookie[val,1]=xx
   Next
   b64Cookie[Char2Num("="),1]=9999  ; flag the = sign

   Return(B64Cookie)
#EndFunction

;----------------------------------------------------------------------------
; Base64StringFromClearString(B64Cookie,clearstring)
;           A useful function that will encode a text string
;
;           B64Cookie   == Value returned by the B64GetCookie function.
;           clearstring == text string to encode
;
;           Returns:  Base64 encoded string
;----------------------------------------------------------------------------
#DefineFunction Base64StringFromClearString(B64Cookie,clearstring)
  s=StrLen(clearstring)
  bb=BinaryAlloc(s)
  BinaryPokeStr(bb,0,clearstring)
  b64bb=Base64BBFromClearBB(B64Cookie,bb)
  s=BinaryPeekStr(b64bb,0,BinaryEodGet(b64bb))
  BinaryFree(bb)
  BinaryFree(b64bb)
  Return(s)
#EndFunction

;----------------------------------------------------------------------------
;   Base64BBFromClearBB(B64Cookie,clearbb)
;            A core, low level conversion function not necessarily
;            normally used by most users of these UDFs.
;            Converts a binary buffer holding data to a new binary
;            buffer holding Base64 encoded data.
;
;            B64Cookie  == Value returned by the B64GetCookiefunction.
;            clearbb    == A binary buffer holding non-encoded text. (May be binary data)
;
;            Returns:  A binary buffer containing clear text
;----------------------------------------------------------------------------
#DefineFunction Base64BBFromClearBB(B64Cookie,clearbb)
   ;clearbb contains bytes to be converted into base64 format
   ;how many triplets
   clearbytes=BinaryEodGet(clearbb)
   cleartriplets= clearbytes/3
   clearremnants= clearbytes mod 3
   ;if clearremnants !=0 then cleartriplets=cleartriplets+1
   b64quads=ClearTriplets
   If clearremnants!=0 Then b64quads=b64quads+1
   b64bytes= b64quads*4  + (b64quads/16)*2  + 6; 4bytes per quad + CRLF every 16 quads plus 6 in case I got the math wrong
   ;Only 16 quads per line allowed
   quadlinecount=0
   B64BB=BinaryAlloc(b64bytes)
   For xx= 1 To cleartriplets
      c1 = BinaryPeek(clearbb,(xx-1)*3+0)
      c2 = BinaryPeek(clearbb,(xx-1)*3+1)
      c3 = BinaryPeek(clearbb,(xx-1)*3+2)

      d1 =                      c1 >> 2
      d2 = ( (c1 &  3) << 4) | (c2 >> 4)
      d3 = ( (c2 & 15) << 2) | (c3 >> 6)
      d4 = ( (c3 & 63)     )
      quad=StrCat(B64Cookie[d1,0],B64Cookie[d2,0],B64Cookie[d3,0],B64Cookie[d4,0])
      BinaryPokeStr(b64BB,BinaryEodGet(b64bb),quad)
      quadlinecount=quadlinecount+1
      If (quadlinecount mod 16)==0 Then BinaryPokeStr(b64BB,BinaryEodGet(b64bb),@CRLF)
   Next xx
   Switch clearremnants
      Case 1
          c1=BinaryPeek(clearbb,(cleartriplets)*3+0)
          d1 =                      c1 >> 2
          d2 = ( (c1 &  3) << 4)
          quad=StrCat(B64Cookie[d1,0],B64Cookie[d2,0],"==")
          Continue
      Case 2
          c1=BinaryPeek(clearbb,(cleartriplets)*3+0)
          c2 = BinaryPeek(clearbb,(cleartriplets)*3+1)
          d1 =                      c1 >> 2
          d2 = ( (c1 &  3) << 4) | (c2 >> 4)
          d3 = ( (c2 & 15) << 2)
          quad=StrCat(B64Cookie[d1,0],B64Cookie[d2,0],B64Cookie[d3,0],"=")
          Continue
      Case 1
      Case 2
         BinaryPokeStr(b64BB,BinaryEodGet(b64bb),quad)
         quadlinecount=quadlinecount+1
         If (quadlinecount mod 16)==0 Then BinaryPokeStr(b64BB,BinaryEodGet(b64bb),@CRLF)
   EndSwitch
   Return(b64BB)
#EndFunction

;----------------------------------------------------------------------------
; OpenUrl : Open html page with ie in visible or hidden mode
;
;           url      == Full URL to navigate to
;           visible  == @TRUE  => visible mode
;                       @FALSE => hidden mode
;           userid   == userid for http authentication
;           pswd     == password for http authentication
;
;----------------------------------------------------------------------------
#DefineFunction OpenUrl(url, visible, userid, pswd)
   Browser = ObjectOpen("InternetExplorer.Application")
   If( visible == @OFF || visible == @ON) Then
      browser.visible = visible
   Else
      browser.visible = @TRUE
   EndIf

   If userid == "" || pswd == ""
      browser.navigate(url)
   Else
      ; Note: All headers must be terminated with a
      ; carriage return linefeed pair.

      ;The format for Authorization header is as follow:
      ;    Authorization: Basic XXXXXXX

      ; Where XXXXXX is Base64 encoded string: "UserName:UserPassword." Base64 is described in RFC1113 and some
      ; public domain utilities for Base64 decoding/encoding are available.
      str = StrCat(userid,":",pswd)
      B64Cookie=B64GetCookie()
      str_64=Base64StringFromClearString(B64Cookie,str)
      Message(str,str_64)


      headerstr = StrCat("Authorization: Basic ", str_64, @CRLF)
      browser.Navigate(:: URL = url, Headers = headerstr)

   EndIf
   ;-- Wait for it to not be busy
   While 1
      busystate=browser.Busy
      readystate=browser.ReadyState
      If busystate==0 && readystate==4 Then Break
      TimeDelay(0.5)
   EndWhile
   Return browser
#EndFunction


url = "http://www.whereever.com"
visible = @TRUE
userid = "johndoe"
pswd = "xxxxxx"
objbrowser = OpenUrl(url, visible, userid, pswd)


;Close objects
objbrowser = 0
Exit

Please let me know if it resolves the issue.

Question:

Recently my scripts that include my http authentication usernames and passwords in the URL ceased working, resulting in in an "Invalid Syntax Error" and "The page cannot be displayed" message in Internet Explorer.
The format I am using is http://username:password@mydomain.com

Please note: These DID work before, and do work from other computers, which leads me to believe that it has something to do with my browser here. Any suggestions are gratefully appreciated!

Answer:

I've seen similar related roadblocks that point back to this update, but haven't had time to explore the details further (yet) http://www.microsoft.com/technet/security/bulletin/MS04-004.mspx Many more having this problem, per this: http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe=UTF-8&q=invalid+syntax+username%3Apassword+ie6 Update:
A security update is available that modifies the default behavior of Internet Explorer for handling user information in HTTP and in HTTPS URLs http://support.microsoft.com/default.aspx?scid=kb;en-us;834489

If Using WinIet:

URLs that are opened by WinInet functions and use an HTTP or an HTTPS URL that includes user information when they call a WinInet or Urlmon function such as iOpenURL, rewrite the object to use one of the following methods to send user information to the Web site: Use the iOptionSet function and include the following option flags: INTERNET_OPTION_USERNAME and INTERNET_OPTION_PASSWORD.

Article ID:   W17008

File Created: 2014:07:18:09:51:38

Last Updated: 2014:07:18:09:51:38

Database Search

TechHome

HTTP Authentication

Question:

Answer:

More:

Question:

Answer:

If Using WinIet: