From: Rich Kilmer <rich@...>
Date: 2002-02-19T02:23:57+09:00
Subject: RE: net/http or webfetcher with pasworded urls

Ron,

> -----Original Message-----
> From: Ron Jeffries [mailto:ronjeffries@REMOVEacm.org]
> Sent: Sunday, February 17, 2002 10:06 PM
> To: ruby-talk ML; undisclosed-recipients:
> Subject: Re: net/http or webfetcher with pasworded urls
>
>
> On Mon, 18 Feb 2002 00:37:42 +0000 (UTC), Niklas Frykholm
> <r2d2@acc.umu.se> wrote:
>
> >
> >		require 'net/http'
> >
> >		Net::HTTP.start( 'auth.some.domain' ) {|http|
> >			response , = http.get( '/need-auth.cgi',
> >					'Authentication' =>
> >
> ["#{account}:#{password}"].pack('m').strip )
> >			print response.body
> >		}
>
> Hmmm, when I do this it still gives the 401 error.  Got me pretty
> confused, I must say ...

HTTP authentication works through the Authorization header (which is what
the above code does...but the format is wrong???).

According to my HTTP Pocket Reference, the format of the Authorization
header in an HTTP request is:

GET /protectedpage.html HTTP/1.0
Authorization: BASIC s2dfVDdadfDfd==

Where that big nasty string after BASIC is the base64 encoded value of
'username:password'.  In the above example the code...

["#{account}:#{password}"].pack('m').strip

...gives you a base64 encoding.  I think that the problem with the above
code is they left out the word BASIC (and again, had the wrong header)

Net::HTTP.start( 'auth.some.domain' ) {|http|
 response , = http.get( '/whatever.html',
	'Authorization' =>
      "BASIC "+["#{account}:#{password}"].pack('m').strip )
	print response.body
}

Give that a whirl.

>
> Thanks, I'll keep tweaking. Guess I'll have to set up a
> password-protected page just to test on ... I can't publish the one I'm
> working on at the moment for folks to try.
>
> In my case I'm wanting to put in a regular get from /foobar.htm, not to
> a cgi file. As I mentioned in the first post, using the username and
> password in the url in a browser works fine.

That's because the browser takes what you put in the URL and sticks in in
the Authorization header :)

-Rich