HTTP Authentication in a URL
When reading through the Selenium FAQ, I noticed a piece of coolness that I didn't know existed in HTTP Authentication (Selenium FAQ – authentication). RFC 1738 specifies the following scheme for specifying authentication information in a url //<user>:<password>@<host>:<port>/<url-path>. I have been familiar with this for commanline based protocols (ftp/telnet and their secure equivalents) but didn't realise that it would work in a browser. In a browser you can specify http://user:password@server:80/path to do basic http authentication. While this ia a bad idea for usernames and passwords in real applications, it is a great tool for development purposes. My firefox speeddial plugin now has development pages specified in this way.
Of course this approach is not a silver bullet, and other tools are needed. I have used this technique to access websphere portal and webapps hosted on a WebSphere Portal server, as well as applications using HTTP Authentication on Tomcat Servers. Unforutnately it doesn't work with the WebSphere administration console, but thankfully you can simulate the form based login using the following type of url: https://serverName:10039/ibm/console/secure/securelogon.do? action=secure&j_username=username&j_password=password
The combination of //<user>:<password>@<host>:<port>/<url-path> tye urls, and faking login forms, makes it possible to access most web urls very quickly in a browser environment. 1
1 -Internet explorer doesn't support this for recent browsers (see: http://support.microsoft.com/kb/834489) ↩
May 8th, 2009 at 9:30 pm
this is often useful in scripts and for mobile applications that deal with http requests and otherwise can’t authenticate using more convential popup method
July 8th, 2009 at 2:27 pm
Whereas RFC 1738 actually forbids HTTP authentication in URL (3.3: “No user name or password is allowed.”), it’s a very useful tool even for real applications. With Firefox-like target browsers, it can replace form authentication completely.