Question

I’m trying to authenticate an android client app to my server ruby on rails app which uses Devise gem. But I’ve tried http authentication, and post requests to authenticate, and the server just responds 200 for any given username/password.

I’ve already set up the config.http_authenticatable = true and the :database_authenticable at the user model…

I’ll post my authenticate method so u guys can have a look on it…

public static boolean authenticate(User user, String verb) throws IOException, JSONException
{

    DefaultHttpClient httpClient = new DefaultHttpClient();
    HttpPost httpPost = new HttpPost(verb);

     CredentialsProvider credProvider = new BasicCredentialsProvider();
     credProvider.setCredentials(new AuthScope(AuthScope.ANY_HOST, AuthScope.ANY_PORT),
            new UsernamePasswordCredentials(user.getMail(), user.getPassword()));

    httpClient.setCredentialsProvider(credProvider);

    List<NameValuePair> nameValuePairs = new ArrayList<NameValuePair>();  
    nameValuePairs.add(new BasicNameValuePair("email", user.getMail()));  
    nameValuePairs.add(new BasicNameValuePair("password", user.getPassword()));  
    httpPost.setEntity(new UrlEncodedFormEntity(nameValuePairs));

    HttpResponse httpResponse = httpClient.execute(httpPost);


    int statusCode = httpResponse.getStatusLine().getStatusCode();
    //JSONObject resp = null;

     if (statusCode < 200 || statusCode >= 300){
        throw new IOException("Error");
     }


    return true;
}

Answer 1

If server is responding 200, it really sounds like server side configuration, so you should double-check your URLs are actually secured, using a desktop web browser and a tool like Fiddler so you can see everything. Pay particular attention to the Authentication headers, and the Status codes; at the least you should see a 401 from the server to start things off.

You can also turn on diagnostics for Apache HTTP on your device, and it will also dump headers and content to LOGCAT, so you can make sure everything is proceeding.

Check the WWW-Autnenticate header’s contents, it will specify which schemes are accepted. The client side will re-request the URL, but it will put the Authorization header into its request.

In short, make sure your server side works outside of your application, in an environment that’s easier to troubleshoot.

Client side, it looks like you are only activating BASIC authentication (everyone stop using it!), and your endpoint may only want DIGEST or NTLM or KERBEROS or any other authentication scheme than BASIC. Since it looks like you didn’t set up for SSL, certainly use at least DIGEST or you have clear text issues!

Using form variables (for authentication) only works at the application level, and not the HTTP protocol level, which uses HTTP Headers (WWW-Autnenticate, Authorization) and Status codes (401, 403) for the authentication process. And again, if you aren’t configuring your server (and client) for SSL-only, there will be clear text problems.