krtek4 / MultiPass

Automatically login to Basic Authentication using data based on URL regexp.
http://gilles.crettenand.info/MultiPass
Do What The F*ck You Want To Public License
87 stars 22 forks source link

Base64 encode feature #68

Closed frjariello closed 4 years ago

frjariello commented 4 years ago

Is it possible to implement the possibility of Base64 encoding for authorization? In my case it is used for access to plc webserver, and in the sector it is often used and would be really convenient.

Thanks

krtek4 commented 4 years ago

Hi,

I am not sure what you mean by that ?

Credentials are always encoded in Base64 when performing a HTTP Basic Authentication according to the RFC.

In the case of this extension, the browser does this automatically when provided with the credentials.

Do you have a usecase where the extension is not working ?

frjariello commented 4 years ago

Hi, yes as I wrote it does not work for access to a webserver of a plc, for this reason I thought it was not encoding in Base64. Just to understand the possible problem, I made a small app in Android, where I send authentication with this code:

String authorization = "Basic " + Base64.encodeToString(usernamePassword.getBytes("UTF-8"), Base64.NO_WRAP); map.put("Authorization", authorization); webView.loadUrl("http://myWebserver/", map);

and it works properly. Thanks bye

krtek4 commented 4 years ago

Hi,

As I said, the Base64 encoding is part of the standard. all HTTP basic authentication use it. This part is also handled by the browser.

So I can assure you that the extension works properly with any webserver respecting the standard.

Can you give me more information about your setup ?

When the extension tries to send credentials, you can see a small square on the extension icon that can be various colors :

Also, if you click the extension icon, all credentials currently matching the currently opened URL have a green background.

Can you please check if the credentials you entered are correctly matched for the domain (green background when the extension icon is clicked), and report the color of the small square ?

Also, "it does not work for access to a webserver of a plc" is not a use case, it is a statement. If I am not able to reproduce your issue, I cannot help you :) I used the extension to connect to a variety of different webservers, using various backend technologies without any issues. So you'll have to be a lot more specific or ideally provide me credentials and access to the server posing the issue :)

Best,

frjariello commented 4 years ago

Thanks for your interest. The background is green, but I can't see any changes on the icon :( I have enabled you, if you want to check, a temporary user accessible remotely , which I have also already tested with my android app and it works. Thanks again, if you want to waste time, as your extension would be really comfortable for me :)

bye

krtek4 commented 4 years ago

Hi,

Thanks for the access.

As far as I can tell, the link you provided does not ask for an authentication, instead it redirects to a login page using a 302 HTTP status code :

image

The mechanism provided by the browser to provide credentials only kicks in when the browser returns a 401 HTTP status code (see https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/webRequest/onAuthRequired for details).

Probably the piece of code you implemented on Android works because the webserver authenticates the user if the credentials are present, and otherwise redirect to the login page. In the case of this extension, credentials are only sent if asked by the webserver.

I don't think there's something I can do for you. Sorry.

frjariello commented 4 years ago

Ok, I understand, unfortunately I had imagined a problem of this type, thanks for the effort, you were still very kind. Thanks again Good job, bye