R – Classic ASP: Get “Authorization” Header

asp-classicauthenticationhttp-headers

I've been searching for a solution on the internet for this, and can not find it anywhere.

I've setup a simple POST request through Fiddler for an ASP page on my local machine:

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, application/x-shockwave-flash
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322; .NET CLR 1.0.3705; .NET CLR 2.0.50727)
Host: localhost
Connection: Keep-Alive
Authorization: Basic xW91bsdtcyNqYTpfs8Jkb4ql
Content-Length: 9

asdfdfdsf

The ASP page contains the following line:

Response.Write(Request.ServerVariables("HTTP_Authorization"))

Instead of writing out "Basic …..", it doesn't write anything at all. If I change "HTTP_Authorization" to any of the other headers (HTTP_Content_Length), I can pull in their values.

Is there a reason ASP is refusing to let me see that specific header?

Thanks!

Best Answer

Apparently it was being removed by the server's windows auth

I unchecked "Integrated Windows authentication" and the header started showing up correctly

Related Solutions

How to send a header using a HTTP request through a cURL call

   -H/--header <header>
          (HTTP)  Extra header to use when getting a web page. You may specify
          any number of extra headers. Note that if you should  add  a  custom
          header that has the same name as one of the internal ones curl would
          use, your externally set header will be used instead of the internal
          one.  This  allows  you  to make even trickier stuff than curl would
          normally do. You should not replace internally set  headers  without
          knowing  perfectly well what you're doing. Remove an internal header
          by giving a replacement without content on the  right  side  of  the
          colon, as in: -H "Host:".

          curl  will  make sure that each header you add/replace get sent with
          the proper end of line marker, you should thus not  add  that  as  a
          part  of the header content: do not add newlines or carriage returns
          they will only mess things up for you.

          See also the -A/--user-agent and -e/--referer options.

          This option can be used multiple times to add/replace/remove  multi-
          ple headers.

Example:

curl --header "X-MyHeader: 123" www.google.com

You can see the request that curl sent by adding the -v option.

Authentication versus Authorization

Authentication is the process of ascertaining that somebody really is who they claim to be.

Authorization refers to rules that determine who is allowed to do what. E.g. Adam may be authorized to create and delete databases, while Usama is only authorised to read.

The two concepts are completely orthogonal and independent, but both are central to security design, and the failure to get either one correct opens up the avenue to compromise.

In terms of web apps, very crudely speaking, authentication is when you check login credentials to see if you recognize a user as logged in, and authorization is when you look up in your access control whether you allow the user to view, edit, delete or create content.

Related Topic