本文共 3274 字，大约阅读时间需要 10 分钟。
检查HTTP 的 Digest 认证. since http1.1
代码如下所示：(此代码还不完善, RFC2617算法未实现).
<%@ page pageEncoding="UTF-8" contentType="text/html;charset=UTF-8" %><%@ page import="sun.misc.BASE64Decoder" %><%@ page import="java.io.IOException" %><%@ page import="java.util.UUID" %><%@ page import="java.util.HashMap" %><%@ page import="java.util.Map" %><%! // 检查HTTP 的 Basic认证. since http1.0 public static boolean checkAuth(HttpServletRequest request, String _username, String _password){ boolean authOK = false; // 认证后每次HTTP请求都会附带上 Authorization 头信息 String Authorization = request.getHeader("Authorization"); if(null == Authorization || Authorization.trim().isEmpty()){ // 需要认证 return authOK; } // 示例数据, 没有换行,有逗号,也有空格 // Digest username="admin", realm="DIGEST tiemao", // nonce="227c89449fd644a3b9df12e7cb8b0e33", uri="/digest.jsp", // algorithm=MD5, response="a8bc07c1d6dc38802ce538247e22f773", // qop=auth, nc=00000001, cnonce="f337ac5d88670ef5" String[] digestArray = Authorization.split("\\s+"); if(null == digestArray || digestArray.length < 2){ return authOK; } // Map authMap = new HashMap (); for(int i = 0; i < digestArray.length; i++){ String paraAndValue = digestArray[i]; // String[] pvArray = paraAndValue.split("="); if(null == pvArray || 2 != pvArray.length){ continue; // 不处理0 } String key = pvArray[0]; String value = pvArray[1]; // if(null==key || null == value){ } // value = value.replace("'",""); value = value.replace(",",""); value = value.replace("\"",""); value = value.trim(); authMap.put(key, value); } // String username = authMap.get("username"); String nonce = authMap.get("nonce"); String response = authMap.get("response"); // 这里应该有个 RFC2617 算法,与客户端一致,即计算用户密码 if(_username.equalsIgnoreCase(username) && checkAuth_RFC2617(_username, _password, response)){ authOK = true;// 认证成功, } // return authOK; } // RFC2617 运算,这算法比较复杂,暂时未实现 // 参考地址: http://www.faqs.org/rfcs/rfc2617.html public static boolean checkAuth_RFC2617(String _username,String _password, String response){ boolean authOK = false; if(null != _username || null !=_password || response.equalsIgnoreCase(response)){ authOK = true;// 认证成功, } return true; } // 不依赖 this 状态的方法,其实都应该设置为 static public static void requireDigestAuth(HttpServletResponse response, String nonce){ // 发送状态码 401, 不能使用 sendError，坑 response.setStatus(401,"Authentication Required"); // String authHeader = "Digest realm=\"DIGEST tiemao\""; authHeader += ",nonce=\""+ nonce +"\""; authHeader += ",algorithm=MD5"; authHeader += ",qop=\""+ "auth" +"\""; // 发送要求输入认证信息,则浏览器会弹出输入框 response.addHeader("WWW-Authenticate", authHeader); return; }%><% // String Authorization = request.getHeader("Authorization"); // String _username = "admin"; String pwd = "11111111"; boolean authOK = checkAuth(request, _username, pwd); // if (!authOK) { // String nonce = UUID.randomUUID().toString().replace("-",""); // 如果认证失败,则要求认证 requireDigestAuth(response, nonce); return; }%> DIGEST认证示例 R U OK? <%=_username %>. Your Password is <%="********"%> 代码如上所述,. 转载地址：http://mhyto.baihongyu.com/