Capturing Authorization token from Request Header

1
votes

I have been working on a Web (HTML/HTTP) script wherein there is a step to validate the action by entering the password to approve certain doc.

The step is failing due to 401 Error. When dug deeper,the authorization token "Authorization:Basic aXRlc3QwMDE6SlZuS1NYU14=" is getting passed.

Tried correlating it, but as it is generated at the client side after i click on Approve in the application, it cannot be correlated. The value is changing every time i try to approve a doc. Is there any way to capture the Authorization value from the Request Header and pass it in the same request? Or is this the limitation with the Web protocol?

I added this header since i was unable to correlate the value.. web_add_header("Authorization","Basic aXRlc3QwMDE6SlZuS1NYU14=");

This is the error i am getting

"HTTP Status-Code=401 (Unauthorized) for "https:***********************"

Appreciate your responses!!

Thanks, RAK

1
loadrunner

1 Answers

2
votes

Web HTTP/HTML protocol builds Authorization header basing on credentials provided by web_set_user API as response on HTTP 401 status.

web_set_user("<username>", "<password> ", "<server>:<port>");

The structure of this header depends on the Authentication type (Basic, NTLM, Digest or Negotiate). We have option to send such header in advance (force authentication) without receiving HTTP 401 from the server (for example to force Basic authentication we can use web_set_sockets_option("INITIAL_AUTH", "Basic"); step.

Another way to provide credentials is web_add_header API. Like: web_add_header("Authorization", " Basic aXRlc3QwMDE6SlZuS1NYU14=");

Basic authentication token is base64 encoded string that includes “:” combination…

For the example above it’s - itest001:JVnKSXS^

I suggest to decode several samples from different capturing sessions to understand the logic and then decide which method is matching the client behavior.