Question

I have a requirement to perform HTTP authentication logic within a servlet application, rather than delegating this task to the container.

Specifically, I need a way of taking the headers of an HttpServletRequest which contains HTTP auth headers, and having them decoded into a data structure representing the supplied credentials, which the application can then process. Both basic and digest auth should be supported.

I could write this by hand, it wouldn’t be too much of a chore, the RFCs are all well documented, but I’d quite like to use an off-the shelf library to do it for me.

My first thought was Spring Security, but from what I can tell this delegates this task to the container (I’m a bit unclear on that, it’s a complicated code base).

Anyone know of any others?

Answer 1

• For BASIC, it is very easy to implement – just read the header, base64 decode it and split it on the ‘:’ character. You can also use use Spring’s BasicProcessingFilter, and supply your instance of AuthenticationManager.
• With Digest, you cannot get the password from the request (that’s the whole point…). Implementing all the details is not a trivial task, even thought the protocol is well documented. Therefore I’d go with Spring’s DigestProcessingFilter. In this case you need to supply the UserDetailsService who provides the user’s password based on the username (for the digest).