服务器是怎么要求客户端强行弹出身份验证窗口的

我们访问tomcat服务器的时候如果试图访问Tomcat Manager就会发现浏览器弹出一个登陆对话框，和我们平常的网页对话框不同，而且查看页面的时候查不到生成这个对话框的代码，禁止脚本也毫无作用。手头的资料对这个东西没有任何介绍，它到底是怎么弹出来的呢？


用jmeter创建一个http request的sampler，再建一个view result tree的lisenter来看看服务器返回了些什么污七八糟的：

HTTP response headers:
HTTP/1.1 401 Unauthorized
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 08:00:00 CST
WWW-Authenticate: Basic realm="Tomcat Manager Application"
Content-Type: text/html;charset=utf-8
Content-Length: 954
Date: Thu, 30 Jun 2005 09:27:26 GMT
Server: Apache-Coyote/1.1


嘿嘿，原来是一个带WWW-Authenticate的401错误啊。自己写个jsp模拟一下看看怎么样：

<%
response.addHeader("WWW-Authenticate","Basic realm=\"Tomcat Manager Application\"");
response.sendError(401,"Unauthorized");
%>

果然，一个一模一样的登陆窗口跳出来了。不过身份验证的具体过程要怎么做呢？google了一下，果然看到好东西了： http://www.chinadata.cn/showContent.asp?projectID=2083



按照说明构造了一个jsp文件：

<%
sun.misc.BASE64Decoderdecoder=newsun.misc.BASE64Decoder();
booleanauthenticated=false;
Stringauthorization=request.getHeader("authorization");
System.out.println("authorization:"+authorization);
if(authorization!=null){
if(authorization.startsWith("Basic")){
authorization=authorization.substring(authorization.indexOf('')+1);
byte[]bytes=decoder.decodeBuffer(authorization);
authorization=newString(bytes);
StringuserName=authorization.substring(0,authorization.indexOf(':'));
Stringpassword=authorization.substring(authorization.indexOf(':')+1);
System.out.println("userName:"+userName);
System.out.println("password:"+password);
authenticated=userName.equals("abc")&&password.equals("abc");
}elseif(authorization.startsWith("Digest")){
StringuserName=authorization.substring(authorization.indexOf("username="));
userName=userName.substring("username=\"".length());
userName=userName.substring(0,userName.indexOf('"'));
Stringpassword=authorization.substring(authorization.indexOf("response="));
password=password.substring("response=\"".length());
password=password.substring(0,password.indexOf('"'));
authenticated=userName.equals("abc")&&password.equals("3cf1135d3b8e20dd9272d06288569a56");
}
}
if(!authenticated){
//response.addHeader("WWW-Authenticate","Digestrealm=\"TomcatManagerApplication\"");
response.addHeader("WWW-Authenticate","Basicrealm=\"TomcatManagerApplication\"");
response.sendError(401,"Unauthorized");
}else{
out.println("helloabc");
}
%>

cool，和tomcat一模一样的登陆页面做出来了。

用户名密码均为abc，hard code在代码里面了。不过还没查到Digest方式的情况下是对哪些信息进行MD5的