How to do cookie-based authentication by using libcurl REST API? - libcurl

Question

My web server supports cookie-based authentication. But I am not able to understand how to implement it using libcurl REST API. i went thru the example https://curl.haxx.se/libcurl/c/cookie_interface.html as well. but I am confuse how to utilize this example for authentication. Every time I am getting " HTTP/1.1 401 Unauthorized" error
code :
curl_easy_setopt(curl, CURLOPT_URL,
"https://samplepage.com/LicenseReportingApplication/authenticate");
curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
curl_easy_setopt(curl, CURLOPT_COOKIEFILE, ""); /* start cookie engine */
curl_easy_setopt(curl, CURLOPT_POST, 1L);
curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
curl_easy_setopt(curl, CURLOPT_UNRESTRICTED_AUTH, 1L);
curl_easy_setopt(curl, CURLOPT_HTTPAUTH, (long)CURLAUTH_ANY);
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, FALSE);
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_easy_setopt(curl, CURLOPT_PROTOCOLS, CURLPROTO_ALL);
curl_easy_setopt(curl, CURLOPT_USERPWD, "root:admin123");
res = curl_easy_perform(curl);
below is the error log
C:\Windows\System32>C:\Users\xxxxxx\Desktop\lib_curl\lib_curl_test\x64\Debug\lib_curl_test.exe
* Trying 10.63.12.112...
* TCP_NODELAY set
* Connected to samplewebpage.com (10.63.12.112) port 443 (#0)
* schannel: SSL/TLS connection with samplewebpage.com port 443 (step 1/3)
* schannel: disabled server certificate revocation checks
* schannel: verifyhost setting prevents Schannel from comparing the supplied target name with the subject names in server certificates.
* schannel: sending initial handshake data: sending 169 bytes...
* schannel: sent initial handshake data: sent 169 bytes
* schannel: SSL/TLS connection with samplewebpage.com port 443 (step 2/3)
* schannel: failed to receive handshake, need more data
* schannel: SSL/TLS connection with samplewebpage.com port 443 (step 2/3)
* schannel: encrypted data got 872
* schannel: encrypted data buffer: offset 872 length 4096
* schannel: sending next handshake data: sending 326 bytes...
* schannel: SSL/TLS connection with samplewebpage.com port 443 (step 2/3)
* schannel: encrypted data got 59
* schannel: encrypted data buffer: offset 59 length 4096
* schannel: SSL/TLS handshake complete
* schannel: SSL/TLS connection with samplewebpage.com port 443 (step 3/3)
* schannel: stored credential handle in session cache
* Server auth using Basic with user 'root'
> POST /LicenseReportingApplication/authenticate HTTP/1.1
Host: samplewebpage.com
Authorization: Basic cm9vdDphZG1pbjEyMw==
Accept: */*
Content-Type: application/x-www-form-urlencoded
Expect: 100-continue
* schannel: client wants to read 16384 bytes
* schannel: encdata_buffer resized 17408
* schannel: encrypted data buffer: offset 0 length 17408
* schannel: encrypted data got 293
* schannel: encrypted data buffer: offset 293 length 17408
* schannel: decrypted data length: 263
* schannel: decrypted data added: 263
* schannel: decrypted data cached: offset 263 length 16384
* schannel: encrypted data buffer: offset 0 length 17408
* schannel: decrypted data buffer: offset 263 length 16384
* schannel: schannel_recv cleanup
* schannel: decrypted data returned 263
* schannel: decrypted data buffer: offset 0 length 16384
< HTTP/1.1 302 Found
< Date: Mon, 11 Feb 2019 03:58:51 GMT
< Server: Apache
< Set-Cookie: JSESSIONID=9AD72025C7716CA14346A6F9B7E1F49C; Path=/LicenseReportingApplication; Secure; HttpOnly
< Location: /LicenseReportingApplication
< Content-Length: 0
< Connection: close
<
* Closing connection 0
* schannel: shutting down SSL/TLS connection with samplewebpage.com port 443
* schannel: clear security context handle
* Issue another request to this URL: 'https://samplewebpage.com/LicenseReportingApplication'
* Switch from POST to GET
* Hostname samplewebpage.com was found in DNS cache
* Trying 10.63.12.112...
* TCP_NODELAY set
* Connected to samplewebpage.com (10.63.12.112) port 443 (#1)
* schannel: SSL/TLS connection with samplewebpage.com port 443 (step 1/3)
* schannel: re-using existing credential handle
* schannel: incremented credential handle refcount = 2
* schannel: sending initial handshake data: sending 169 bytes...
* schannel: sent initial handshake data: sent 169 bytes
* schannel: SSL/TLS connection with samplewebpage.com port 443 (step 2/3)
* schannel: failed to receive handshake, need more data
* schannel: SSL/TLS connection with samplewebpage.com port 443 (step 2/3)
* schannel: encrypted data got 872
* schannel: encrypted data buffer: offset 872 length 4096
* schannel: sending next handshake data: sending 326 bytes...
* schannel: SSL/TLS connection with samplewebpage.com port 443 (step 2/3)
* schannel: encrypted data got 59
* schannel: encrypted data buffer: offset 59 length 4096
* schannel: SSL/TLS handshake complete
* schannel: SSL/TLS connection with samplewebpage.com port 443 (step 3/3)
* Server auth using Basic with user 'root'
> GET /LicenseReportingApplication HTTP/1.1
Host: samplewebpage.com
Authorization: Basic cm9vdDphZG1pbjEyMw==
Accept: */*
* schannel: client wants to read 16384 bytes
* schannel: encdata_buffer resized 17408
* schannel: encrypted data buffer: offset 0 length 17408
* schannel: encrypted data got 165
* schannel: encrypted data buffer: offset 165 length 17408
* schannel: decrypted data length: 135
* schannel: decrypted data added: 135
* schannel: decrypted data cached: offset 135 length 16384
* schannel: encrypted data buffer: offset 0 length 17408
* schannel: decrypted data buffer: offset 135 length 16384
* schannel: schannel_recv cleanup
* schannel: decrypted data returned 135
* schannel: decrypted data buffer: offset 0 length 16384
< HTTP/1.1 302 Found
< Date: Mon, 11 Feb 2019 03:58:53 GMT
< Server: Apache
< Location: /LicenseReportingApplication/
< Content-Length: 0
<
* Connection #1 to host samplewebpage.com left intact
* Issue another request to this URL: 'https://samplewebpage.com/LicenseReportingApplication/'
* Found bundle for host samplewebpage.com: 0x475d90 [can pipeline]
* Re-using existing connection! (#1) with host samplewebpage.com
* Connected to samplewebpage.com (10.63.12.112) port 443 (#1)
* Server auth using Basic with user 'root'
> GET /LicenseReportingApplication/ HTTP/1.1
Host: samplewebpage.com
Authorization: Basic cm9vdDphZG1pbjEyMw==
Accept: */*
* schannel: client wants to read 16384 bytes
* schannel: encrypted data buffer: offset 0 length 17408
* schannel: encrypted data got 2816
* schannel: encrypted data buffer: offset 2816 length 17408
* schannel: decrypted data length: 287
* schannel: decrypted data added: 287
* schannel: decrypted data cached: offset 287 length 16384
* schannel: encrypted data length: 2491
* schannel: encrypted data cached: offset 2491 length 17408
* schannel: failed to decrypt data, need more data
* schannel: schannel_recv cleanup
* schannel: decrypted data returned 287
* schannel: decrypted data buffer: offset 0 length 16384
< HTTP/1.1 401 Unauthorized
< Date: Mon, 11 Feb 2019 03:58:54 GMT
< Server: Apache
< x-frame-options: SAMEORIGIN
< Set-Cookie: JSESSIONID=8EAF9C77B57FD187DD660ACF66692851; Path=/LicenseReportingApplication; Secure; HttpOnly
< Content-Type: text/html;charset=ISO-8859-1
< Content-Length: 4447
<
* schannel: client wants to read 4447 bytes
* schannel: encrypted data buffer: offset 2491 length 17408
* schannel: encrypted data got 1994
* schannel: encrypted data buffer: offset 4485 length 17408
* schannel: decrypted data length: 4447
* schannel: decrypted data added: 4447
* schannel: decrypted data cached: offset 4447 length 16384
* schannel: encrypted data buffer: offset 0 length 17408
* schannel: decrypted data buffer: offset 4447 length 16384
* schannel: schannel_recv cleanup
* schannel: decrypted data returned 4447
* schannel: decrypted data buffer: offset 0 length 16384

Answer 1

The 401 Unauthorized response means that your Authorization: header was deemed incorrect or not enough by the server. Failing to issue the right cookie won't cause a 401.

Answer 2

int main(int argc, const char* args[])
{
CURL *curl;
CURLcode res;
curl_global_init(CURL_GLOBAL_ALL);
curl = curl_easy_init();
if (curl) {
curl_easy_setopt(curl, CURLOPT_URL, "https://sampleurl.com/LicenseReportingApplication/authenticate");
curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
curl_easy_setopt(curl, CURLOPT_COOKIEFILE, ""); /* start cookie engine */
curl_easy_setopt(curl, CURLOPT_POSTFIELDS, "username=root&password=urpass");
curl_easy_setopt(curl, CURLOPT_POSTREDIR, CURL_REDIR_POST_ALL);
curl_easy_setopt(curl, CURLOPT_POST, 1L);
curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
curl_easy_setopt(curl, CURLOPT_UNRESTRICTED_AUTH, 1L);
curl_easy_setopt(curl, CURLOPT_HTTPAUTH, (long)CURLAUTH_ANY);
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, FALSE);
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_easy_setopt(curl, CURLOPT_PROTOCOLS, CURLPROTO_ALL);
res = curl_easy_perform(curl);
/* Check for errors */
if (res != CURLE_OK)
fprintf(stderr, "curl_easy_perform() failed: error %d %s\n", res,
curl_easy_strerror(res));
/* always cleanup */
curl_easy_cleanup(curl);
}
curl_global_cleanup();
return 0;
}