Basic Authentication from url in Restlet

Question

I've been using Restlets "ChallengeResponse" mechanism to authenticate users on the server side.

ChallengeResponse challengeResponse = getRequest().getChallengeResponse();
if( challengeResponse == null ){
     throw new RuntimeException("not authenticated");
}
String login = challengeResponse.getIdentifier();
String password = new String(challengeResponse.getSecret());

From my understanding, "ChallengeResponse" requires that the username and password are put into headers. However a client needs to put the credentials into the url like so:

https://username:[email protected]/my_secure_document

When I looked at what was actually sent, it looks like the password is being Base64 encoded

The client is an external web service (Twilio) who sends the authentication information via the URL instead of the headers....

What is the proper way to authenticate in this fashion using Restlet?

Answer 1

The code fragment you've put above looks like it's on the server side.

I presume your question is about using this URI from the client (and I also presume your client uses Restlet). You can build a reference and extract the username and password using Reference.getUserInfo() like this:

Reference ref = new Reference("https://username:[email protected]/my_secure_document");
String[] userinfo = ref.getUserInfo().split(":"); // "username:password"
String username = userinfo[0];
String password = userinfo[1];
ClientResource clientRes = new ClientResource(ref);
clientRes.setChallengeResponse(ChallengeScheme.HTTP_BASIC, username, password);
clientRes.get();

(Of course, you'll need to test whether the user info is null before splitting.)