Enterprise J2ME Developing Mobile Java Applications [Electronic resources] نسخه متنی

6.5 HTTP Digest Authentication

Basic authentication can be used in a secure network environment. However, in an insecure network, such as the Internet, the problem for basic authentication is obvious: A cracker can easily intercept the clear text username and password, and forge the user's identity. A more secure scheme is to use one-way hashes (digests) to carry user credentials. The HTTP Digest Authentication works as follows.

The client contacts the server and requests a restricted resource.

The server sends a challenge to the client, including a randomly generated nonce value in predefined HTTP headers.

The client calculates a hash using its username, password, and the nonce value according to an algorithm defined in the specification.

The client resends its request with the new authentication header.

The server compares hashes with its own calculations. If the authentication is successful, the client will continue to use the same hash until the server changes the nonce value or the user changes its username and password.

Besides eliminating the clear text username and password, the digest authentication scheme has other important benefits. The server knows only the hash of the password but not the password itself. This prevents insider abuses. The server nonce value is embedded in the hash and therefore cannot be forged. This allows the server to have better control over the authentication process.

6.5.1 Code Example

We can use the DigestAuthHandler class to make the HttpClient object aware of digest authentication. The implementation of DigestAuthHandler is based on Kenneth Ballard's Open Source package "HttpClient." Code snippet from the DigestAuthHandler class is shown in Chapter 20).

Listing 6.8. The DigestAuthHandler class

public class DigestAuthHandler implements Handler {
public DigestAuthHandler (String u, String p) {
username = u;
password = p;
}
public void prepareHeaders(HttpConnection c) throws Exception {
String h = "Digest ";
if(username != null)
h = h + "username=\" + username + "\", ";
if(realm != null)
h = h + "realm=\" + realm + "\", ";
if(nonce != null)
h = h + "nonce=\" + nonce + "\", ";
if(uri != null)
h = h + "uri=\" + uri + "\", ";
if(opaque != null)
h = h + "opaque=\" + opaque + "\", ";
if(qop != null) {
h = h + "qop=\" + qop + "\", ";
// cnonce is a random number generated by the
// client. You should use your device build-in
// random number generator to produce it.
cnonce = "0123456789";
h = h + "cnonce=\" + cnonce + "\", ";
h = h + "nc=" + count + ", ";
// Increase counter by one. The counter will
// be reset when a new nonce comes in.
ncount++;
String nc = Integer.toHexString(ncount);
count = new String("00000000").substring(nc.length()) + nc;
}
h = h + "algorithm=\"MD5\", ";
h = h + "response=\" + getDigest() + "\";
c.setRequestProperty("Authorization", h);
}
public boolean processHeaders (HttpConnection c)
throws Exception {
if ( c.getResponseCode() == 401 ) {
httpMethod = c.getRequestMethod();
uri = c.getFile();
parse (c.getHeaderField("WWW-Authenticate"));
// need to re-send request
return true;
} else {
return false;
}
}
// Other utility methods
}