我們訪問tomcat服務器的時候如果試圖訪問Tomcat Manager就會發現瀏覽器彈出一個登陸對話框，和我們平常的網頁對話框不同，而且查看頁面的時候查不到生成這個對話框的代碼，禁止腳本也毫無作用。手頭的資料對這個東西沒有任何介紹，它到底是怎么彈出來的呢？
用jmeter創建一個http request的sampler，再建一個view result tree的lisenter來看看服務器返回了些什么污七八糟的：
HTTP response headers:
HTTP/1.1 401 Unauthorized
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 08:00:00 CST
WWW-Authenticate: Basic realm="Tomcat Manager Application"
Content-Type: text/html;charset=utf-8
Content-Length: 954
Date: Thu, 30 Jun 2005 09:27:26 GMT
Server: Apache-Coyote/1.1
嘿嘿，原來是一個帶WWW-Authenticate的401錯誤啊。自己寫個jsp模擬一下看看怎么樣：
<%
response.addHeader("WWW-Authenticate","Basic realm=\"Tomcat Manager Application\"");
response.sendError(401,"Unauthorized");
%>
果然，一個一模一樣的登陸窗口跳出來了。不過身份驗證的具體過程要怎么做呢？google了一下，果然看到好東西了：
http://www.chinadata.cn/showContent.asp?projectID=2083按照說明構造了一個jsp文件：
<%
sun.misc.BASE64Decoder?decoder?=?new?sun.misc.BASE64Decoder();
boolean?authenticated?=?false;
String?authorization?=?request.getHeader("authorization");
System.out.println("authorization:"+authorization);
if?(authorization?!=?null)?
{
??if?(authorization.startsWith("Basic")){
????authorization?=?authorization.substring(authorization.indexOf('?')+1);
????byte[]?bytes?=?decoder.decodeBuffer(authorization);
????authorization?=?new?String(bytes);
????String?userName?=?authorization.substring(0,authorization.indexOf(':'));
????String?password?=?authorization.substring(authorization.indexOf(':')+1);
????System.out.println("userName:"+userName);
????System.out.println("password:"+password);
????authenticated?=userName.equals("abc")?&&?password.equals("abc");
??}else?if?(authorization.startsWith("Digest")){
????String?userName?=?authorization.substring(authorization.indexOf("username="));
????userName?=?userName.substring("username=\"".length());
????userName?=?userName.substring(0,userName.indexOf('"'));
????String?password?=?authorization.substring(authorization.indexOf("response="));
????password?=?password.substring("response=\"".length());
????password?=?password.substring(0,password.indexOf('"'));
????authenticated?=userName.equals("abc")?&&?password.equals("3cf1135d3b8e20dd9272d06288569a56");
??}
}
if?(!authenticated){
??//???response.addHeader("WWW-Authenticate","Digest?realm=\"Tomcat?Manager?Application\"");
??response.addHeader("WWW-Authenticate","Basic?realm=\"Tomcat?Manager?Application\"");
??response.sendError(401,"Unauthorized");
}else{
??out.println("hello?abc");
}
%>cool，和tomcat一模一樣的登陸頁面做出來了。
用戶名密碼均為abc，hard code在代碼里面了。不過還沒查到Digest方式的情況下是對哪些信息進行MD5的。