473,387 Members | 1,569 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,387 software developers and data experts.

Setting up HttpListener basic authentication

How does one set up basic authentication on an HttpListener? I know I need to
set the HttpListener.AuthenticationSchemes to AuthenticationSchemes.Basic but
then I'm unsure how and against what (users on the PC?) the Authentication is
occuring. Is there a way for me to receive and control the Authentication
attempt myself?

This is probably obvious but I've found nothing describing it.
Jan 6 '06 #1
3 15743
Hi Sousoux,

Welcome to MSDN newsgroup.
As for the HttpListener component in .net 2.0, it is just rely on the OS's
underlying http.sys kernal module to accept http requests... And for
Security authentication, it is done by the internal code which call
platform authentication apis to autheniticate the client request, and we
can not intercept the authentication progress... (just as we can not
intercept the IIS's authentication process when host our web application in
IIS server) If you want to do some customized athroization task based on
the authenticated client side user identity, you can get it through the
HttpListenerContext. e.g:

private void btnStart_Click(object sender, EventArgs e)
{
_httpsvc = new HttpListener();

string name = System.Environment.MachineName;

_httpsvc.Prefixes.Add("http://localhost:80/httpsvc/");
_httpsvc.Prefixes.Add("http://" + name + ":80/httpsvc/");
_httpsvc.AuthenticationSchemes =
AuthenticationSchemes.Negotiate;

_httpsvc.Start();

MessageBox.Show("http server started....");
IAsyncResult result = _httpsvc.BeginGetContext(new
AsyncCallback(ListenerCallback),_httpsvc);

MessageBox.Show("Waiting for request to be processed
asyncronously.");
}

private void btnStop_Click(object sender, EventArgs e)
{
_httpsvc.Stop();

MessageBox.Show("http server stoped....");
}
public static void ListenerCallback(IAsyncResult result)
{
HttpListener listener = (HttpListener)result.AsyncState;

HttpListenerContext context = listener.EndGetContext(result);
HttpListenerRequest request = context.Request;

HttpListenerResponse response = context.Response;

string responseString = "<HTML><BODY> Hello {0}!</BODY></HTML>";
responseString =
string.Format(responseString,context.User.Identity .Name);

byte[] buffer =
System.Text.Encoding.UTF8.GetBytes(responseString) ;

response.ContentLength64 = buffer.Length;
System.IO.Stream output = response.OutputStream;
output.Write(buffer, 0, buffer.Length);
// You must close the output stream.
output.Close();
}
The context.User.Identity just represent the authenticated client user
identity:

Hope helps.

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

--------------------
Thread-Topic: Setting up HttpListener basic authentication
thread-index: AcYSwqU53vYU/iV5QAieWKg30xHFLQ==
X-WBNR-Posting-Host: 80.13.134.75
From: =?Utf-8?B?TWFydGlu?= <so*****@nospam.nospam>
Subject: Setting up HttpListener basic authentication
Date: Fri, 6 Jan 2006 05:11:03 -0800
Lines: 7
Message-ID: <35**********************************@microsoft.co m>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Utf-8"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
Newsgroups: microsoft.public.dotnet.framework.webservices
NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGXA01.phx.gbl!TK2MSF TNGXA03.phx.gbl
microsoft.public.dotnet.framework.webservices:1326 4
X-Tomcat-NG: microsoft.public.dotnet.framework.webservices

How does one set up basic authentication on an HttpListener? I know I need
to
set the HttpListener.AuthenticationSchemes to AuthenticationSchemes.Basic
but
then I'm unsure how and against what (users on the PC?) the Authentication
is
occuring. Is there a way for me to receive and control the Authentication
attempt myself?

This is probably obvious but I've found nothing describing it.

Jan 9 '06 #2
That's actually not correct when it comes to basic auth. The other
types will authenticate against windows or domain users, but basic
leaves it in your hands and will pass you whatever user and pass they
type in.

With the HttpListener and basic authentication it provides the user
and password to you, you'll need to cast the context.Identity as a
HttpListenerBasicIdentity in order to see the password field. From
here you can check that against your own users that are internal to
your software or use API or new 2.0 classes to autheniticate against a
system or domain.

The only problem I've had that I am curious about, if they put in the
incorrect password you can set the status to 401 Unauthorized, but you
are not permitted to set the WWWAuthenticate HTTP header, so the
browser will not prompt them again, it just goes to a blank page or to
whatever content you've sent back. The other types, I'm currently
using NTLM, work as expected and will prompt a bad password 3 or 4
times before it fails.. but then do not give you the ability to provide
the error page.. so neither way have I been able to truly reproduce IIS
behavior. My next step will be trying to override some of the
Listeners functionality.

Nick Brookins
SAM Systems, Inc

Jan 9 '06 #3
Thanks for your input Nick,

Yes, the HttpListener's implementation is still far from well since it's
just a simple light wight component for accept HTTP request. And for the
authentication error, so far we haven't any good means to intercept it,
actually when hosting in IIS, the authentication error is also handled by
IIS and provide an exception screen rather than opened to our asp.net
extension...

Regards,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)
--------------------
From: nb*******@gmail.com
Newsgroups: microsoft.public.dotnet.framework.webservices
Subject: Re: Setting up HttpListener basic authentication
Date: 9 Jan 2006 13:23:29 -0800
Organization: http://groups.google.com
Lines: 26
Message-ID: <11**********************@g14g2000cwa.googlegroups .com>
References: <35**********************************@microsoft.co m>
<wS**************@TK2MSFTNGXA02.phx.gbl>
NNTP-Posting-Host: 64.199.1.169
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
X-Trace: posting.google.com 1136841815 7986 127.0.0.1 (9 Jan 2006 21:23:35
GMT)
X-Complaints-To: gr**********@google.com
NNTP-Posting-Date: Mon, 9 Jan 2006 21:23:35 +0000 (UTC)
In-Reply-To: <wS**************@TK2MSFTNGXA02.phx.gbl>
User-Agent: G2/0.2
X-HTTP-UserAgent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1;
.NET CLR 1.1.4322; InfoPath.1; .NET CLR 2.0.50727),gzip(gfe),gzip(gfe)
Complaints-To: gr**********@google.com
Injection-Info: g14g2000cwa.googlegroups.com; posting-host=64.199.1.169;
posting-account=SXYE5wwAAAAtcbMjaSZZGoG7fvCnEnQd
Path:
TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!newsfee d00.sul.t-online.de!t-onli
ne.de!news.glorb.com!postnews.google.com!g14g2000c wa.googlegroups.com!not-fo
r-mail
Xref: TK2MSFTNGXA02.phx.gbl
microsoft.public.dotnet.framework.webservices:1330 1
X-Tomcat-NG: microsoft.public.dotnet.framework.webservices

That's actually not correct when it comes to basic auth. The other
types will authenticate against windows or domain users, but basic
leaves it in your hands and will pass you whatever user and pass they
type in.

With the HttpListener and basic authentication it provides the user
and password to you, you'll need to cast the context.Identity as a
HttpListenerBasicIdentity in order to see the password field. From
here you can check that against your own users that are internal to
your software or use API or new 2.0 classes to autheniticate against a
system or domain.

The only problem I've had that I am curious about, if they put in the
incorrect password you can set the status to 401 Unauthorized, but you
are not permitted to set the WWWAuthenticate HTTP header, so the
browser will not prompt them again, it just goes to a blank page or to
whatever content you've sent back. The other types, I'm currently
using NTLM, work as expected and will prompt a bad password 3 or 4
times before it fails.. but then do not give you the ability to provide
the error page.. so neither way have I been able to truly reproduce IIS
behavior. My next step will be trying to override some of the
Listeners functionality.

Nick Brookins
SAM Systems, Inc
Jan 10 '06 #4

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

7
by: Michael Foord | last post by:
#!/usr/bin/python -u # 15-09-04 # v1.0.0 # auth_example.py # A simple script manually demonstrating basic authentication. # Copyright Michael Foord # Free to use, modify and relicense. #...
4
by: Joseph | last post by:
I have an intranet application that I setup using windows authentication through IIS basic authentication. Is there a way to set a timeout, so that after ten minutes the user will be prompted...
1
by: jeremy.stitt | last post by:
Does anyone know if it is possible to set IIS authentication methods (e.g. anonymous access, basic authentication, IWA, etc) in the web.config file? For example, I want to remove Anonymous...
1
by: googlegroups | last post by:
Hello everyone, I need a new web server for our existing website and I don't want subscribe to the whole IIS way of doing things. I thought I would implement a custom web server using the new...
5
by: davesmith | last post by:
I have a very simple console app using an HttpListener to listen for incoming HTTP requests (see code below). My client and server machines are both in an ADS domain and I'm logged into both using...
7
by: Pro1712 | last post by:
Hello, I need to write a simple proxy server. What I want to do is to use HttpListener to get requests from the browser, add some proxy information and some other stuff and send the request to...
6
by: John H Clark | last post by:
I am designing a site that requires AnonymousID. I set my web.config to allow this using <anonymousIdentification enable="true".../as recommended in the documentation. To verify the settings I...
1
by: =?Utf-8?B?V2lsZCBXaWxkIE1pa2U=?= | last post by:
I have a windows service implementation that creates an HttpListener in OnStart to help capture port conflict issues while starting vs. when the service is already started. On Windows 2003 servers...
3
by: Hans-Jürgen Philippi | last post by:
Hi Group, I've created a (very simple) ASP.NET web application with a single *.aspx page and an *.aspx.cs CodeBehind file: By clicking an HTML form button, a text control value is written into a...
0
by: aa123db | last post by:
Variable and constants Use var or let for variables and const fror constants. Var foo ='bar'; Let foo ='bar';const baz ='bar'; Functions function $name$ ($parameters$) { } ...
0
by: ryjfgjl | last post by:
If we have dozens or hundreds of excel to import into the database, if we use the excel import function provided by database editors such as navicat, it will be extremely tedious and time-consuming...
0
by: ryjfgjl | last post by:
In our work, we often receive Excel tables with data in the same format. If we want to analyze these data, it can be difficult to analyze them because the data is spread across multiple Excel files...
0
by: emmanuelkatto | last post by:
Hi All, I am Emmanuel katto from Uganda. I want to ask what challenges you've faced while migrating a website to cloud. Please let me know. Thanks! Emmanuel
0
BarryA
by: BarryA | last post by:
What are the essential steps and strategies outlined in the Data Structures and Algorithms (DSA) roadmap for aspiring data scientists? How can individuals effectively utilize this roadmap to progress...
1
by: nemocccc | last post by:
hello, everyone, I want to develop a software for my android phone for daily needs, any suggestions?
0
by: Hystou | last post by:
There are some requirements for setting up RAID: 1. The motherboard and BIOS support RAID configuration. 2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...
0
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However,...
0
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.