Form-based Authentication
No formal RFC standard
Form-based Login
We are going to describe the sequence of http events when we are accessing a spring boot server endpoint that is protected by form-based authentication. I divided the http conversations into series of talks based on the varying values of JSESSIONID.
Step#1
On browser, access url http://localhost:8080
The browser sends an http GET request:
GET / HTTP/1.1
Host: localhost:8080
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9 The server responds with an http redirect , and advising the browser to redirect the request to the url indicated in the location field in the response. The server is also advising to use the value in JSESSIONID field.
The browser follows the redirect advise, and issues another http GET request with:
Following the server's advice, the browser follows the redirect URL and uses the JSESSIONID.
The server responds with an OK or http 200 containing the html page in the body payload. This ends the first conversation.
The second conversation shall use a new value of JSESSIONID given by the server.
The browser renders the html content and this completes the request. The browser, shows a login form for the user to input username and password. The user then, inputs his username and password, and clicks the Sign in button. This is a POST request that is sent to the server. The browser is able to do this POST action because of the form's method attribute which is marked as post in the above. You will also notice that inside this form is a csrf hidden field, this is used by the server to verify that the login credentials is coming from the user who initiated this request. The browser sends the following http POST content which forms the second conversation.
Step#2
Browser sends a POST request to the server:
You will noticed the username and password is in the header fields, along with an accompanyng _csrf field. This POST request is sort of another request, because the first request that returns the login page uses the same value in the JSESSIONID to track it. However, this second request made by browser when doing the POST is now another request and needs a new JSESSIONID .
The server responds with, and notice the new value in JSESSIONID because the first http talk is completed, and this second one starts a a new conversation and tracked by this new value in JSESSIONID. The server, therefore, advices the browser from now on to use this new value of JSESSIONID:
The browser, again, following the 2nd advice, does another http GET (or redirect advise) to / location and sends below, using the new value of JSESSIONID as advised:
The server responds below content:
and this completes the 2nd talk.
Step#3
The second JSESSIONID the browser has, shall now become his token to access the protected resource in the server. The browser, now access the protected resource and is successfully retrieves the json response. Take note, no more username/password is passed in this request. Below is the browser's GET request which succeeds:
The server seeing the JSESSIONID allows the request to the /api/v1/students/1 and returns the json response. The server response with:
According to Nelson, the JSESSIONID has a valid time period of 30 minutes? So, the browser can make more request and only needing this JSESSIONID and his requests will be granted.
Step#4
Form-based authentication is an improvement to Basic Access Authentication in its ability to do /logout which clears the browser. The last part of the talk is when the browser logs off and sends below:
The server sends a logout confirmation html page with a button:
The browser confirms the logout and sends a POST request below:
The server responds with a redirect advise below:
The browser follows the advice and does an HTTP GET:
The server sends html content of redirected page after logout, and it has new JSESSIONID value:
The browser, renders this redirection page.
This completes our trace of Form-based Authentication.
Last updated
Was this helpful?