Question

I need to identify users according to an URI subset. It has the following pattern http://userinfo@hostname:port/path.

The java.net.URI implementation represents the URI. However, in the servlet I was not able to retrieve the URL/URI containing the "userinfo" URI’s component. I thought the method HttpServletRequest.getRequestURL() would return a full URL, but at some stage the "userinfo" component is being suppressed or ignored.

I realized that when requesting the servlet using curl instead of Firefox, it adds a http basic authorization to the header. So, it could be related to the HTTP Client implementation? The invoker can suppress the "user-info" component?

The following code just iterates through header and tries to read the user-info component.

@SuppressWarnings("unchecked")
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    // 
    try {
        
        PrintWriter out = response.getWriter();
       
        String header;
        for (Enumeration e = request.getHeaderNames(); e.hasMoreElements();) {
             header = e.nextElement().toString();
             out.println(header + ": " + request.getHeader(header));
        }
       
        URI uri = new URI(request.getRequestURL().toString());
        
        out.println("request uri: " + request.getRequestURI());
        out.println("request url: " + request.getRequestURL());
        out.println("userinfo: " + uri.getUserInfo());
    } catch (URISyntaxException e) {
        e.printStackTrace();
    }
   
}

Thanks in advance!

Answer 1

The username and password are passed as part of HTTP authentication, not part of the URL. In particular, the browser will never send it unless it is asked to via the 401 not authorized response.

You can see some examples of how to implement HTTP authentication in a servlet here: http://docstore.mik.ua/orelly/java-ent/servlet/ch08_01.htm