Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Im having some issues getting a website working at my place of work. The issue was rasised when a "double login" occurred from the secure login site. The second login was actually being prompted by the HTTP domain and not HTTPS.

In essence the situation is like this:

  • The user navigates to https://mysite.com/something
  • The login prompt pops up
  • Enter username and password
  • The user is presented with ANOTHER login prompt (IE will say its insecure, and the address bar reflects that)
    • If the user puts in their password the insecure one, they will login to the insecure site.
    • if they hit cancel it will present them with a 401 page
  • Navigating back to https://somesite.com/something will by pass the login prompt and log them in to the secure site automatically (cookie maybe)

I'm a bit confused to why the user isnt being logged in properly the first time (redirected to non-ssl) but any consecutive login will be okay? I've been trying to use fiddler to see what is happening after the user puts in their password the first time and trying to get fiddler to automatically login to the site (with no luck)

I believe the website in question is using Basic Digest authentication.

Thanks for any help

share|improve this question
1  
What happens if you enter a wrong password on purpose at step 3 ? What is the url at step 4 ? –  ixe013 Dec 11 '12 at 16:35
    
Does the page have some non SSL content on it, like images? –  1.618 Dec 11 '12 at 17:24

2 Answers 2

Sounds like the server is passing along a Location header to another page while (or just after) being authenticated.

Depending on how the server(s) (for port 80 and 443) is/are configured, it the page may also simply be coded to go to the http:// page (port 80), on which you wouldn't yet be authenticated (again, depending on the structure).

Can you check the HTTP header, and report if there is a Location header, or if the authentication coding is set to "re-direct to a page on success".

share|improve this answer
    
I doubt it. I understand that the location only changes to http. –  ixe013 Dec 11 '12 at 16:29

Basic and digest authentication make the browser add a header named Authorization. The server is free to read or ignore it. Chances are it will ignore it if there is an authentication cookie set. That cookie is the session cookie. It will be called ASPSESSIONID, JSESSIONID, PHPSESSIONID or something similar.

Here is what is happening :

  1. The first logon fails over HTTPS. Hard to tell why, I am using psychic debugging.
  2. You are redirected to an http page. The server is configured to ask for basic/digest auth, which is does.
  3. You enter your credentials which are accepted this time around. The server gives you a session cookie
  4. Going back to HTTPS, the server ignores the Authorization header (which would most likely fail) since there is a session cookie.

To fix the problem, you must understand why the first authentication is refused.

Fiddler is a proxy. It will not be able to see the encrypted content of the secure login page. You need to add a plugin to your browser to see HTTP headers. If you update your question with the headers, beware. Basic authentication is your plain text password in base64.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.