Check if a user has access to a document using URLConnection

Question

Hi, We have URLs to a list of documents and we would like to check if a user has access to those documents. These documents require user login and password to access. Since the server requires NTLM authentication, we are using the JCIFS API to make a URL Connection to the document and checking the HTTP response code. If the response code is 401, then we are confirming that user does not have access. With this approach, does the document download all the content? Does the response time vary depending on the size of the document? Is there a better approach? Thanks in advance.

Config.setProperty("jcifs.smb.client.username", "<user_name>"); 
Config.setProperty("jcifs.smb.client.password", "<password>");  
URL spURL = new URL("http://&lt;host_name&gt;/&lt;folder_name&gt;/&lt;file_name&gt;";
HttpURLConnection httpURLConnection = (HttpURLConnection) spURL
     .openConnection();
NtlmHttpURLConnection ntlmHttpURLConnection = new NtlmHttpURLConnection(
       httpURLConnection);
int resCode = ntlmHttpURLConnection.getResponseCode()

---

Thanks for your answers. I do not have a requirement to download the document, but my requirement is only to check if a user has access to a document or not. I am looking for a solution which is faster in terms of response and does not vary depending on the size of the document.

Hi, Thanks for your suggestions to set the request type as HEAD. There are lot of HTTP response codes that start with 2, 3, 4 and 5. Can you please explain me how I can interprese this? I am assuming the following intepretation; please correct me if I am wrong.

1. Any response code that starts with 2 means user has access to the document.
2. Any response code that starts with 3, I need to add further logic to make another request to actual URL?? Is there a code how this can be done automatically?
3. Any response code with 401 indicates user does not have access.
4. Any response code starting with 5 indicates, there is a problem with host server.

Answer 1

How about

httpURLConnection.setRequestMethod("HEAD");

?

Answer 2

When you download, there is not really any overhead. If you are not authorized, the server is not going to send the file back.

If you are posting large amount of data, you should use 100-Continue to make sure you are allowed to do so before proceeding. You can do it like this,

httpURLConnection.setRequestProperty("Expect", "100-continue");