Creating Custom HTTP Headers

[nidgep]

Hi

I want to be able to create custom http headers from within an asp page. Then be able to grab the values held within from any required (or subsequent) page.

I am trying to force a login dialog to appear using the

Response.Status = "401 Access Denied"
Response.AddHeader "

http://WWW-Authenticate","Basic

= ""localhost"""
Response.Write "Some page with info about user names And registration"
Response.End()

The user would enter their username and password and click OK. On the server, the values would be decoded from base64 and validated with a databse.
If successful, the username and password would then be re-encypted and added to a custom http header.

...decoded and validated the values....
...now add the custom http headers...

Response.AddHeader "HTTP_UID",strUID
Response.AddHeader "HTTP_PWD", strPWD
etc..



....a n other page would then attempt to read the custom HTTP headers....


<%
Dim strUsername, strPassword
strUsername = Request.ServerVariables(&quot;HTTP_UID&quot
strPassword = Request.ServerVariables(&quot;HTTP_PWD&quot
%>


Is this kind of thing possible 'on the fly'or am I wasting my time?
Is is only possible by adding the custom headers in the IIS manager?

Thanks for any help or pointers.

 

[palbano]

>> Then be able to grab the values held within from any
>> required (or subsequent) page.

Nope. That’s not how HTTP headers work. The client will send whatever HTTP headers it wants to within the HTTP standard. Not what you send it from the server.

-pete

 

[nidgep]

Hi Palbano

Thanks for replying......

However, if that were so then how come if you set the response.status to

Response.Status = &quot;401 Access Denied&quot;
and then add the

Response.AddHeader &quot;

http://WWW-Authenticate&quot;,&quot;Basic

= &quot;&quot;localhost&quot;&quot;&quot;

the client browser would not show the login dialog, would it?

Also if, this were true then why is there a method of the Reponse object named AddHeader?

I am confused!

Can you or anyone shed somemore light on this for me please?

 

[Tarwn]

Ok, The reason your authenticate headers work is because those headers are standard headers that the browser knows how to handle. I think the confusion that is occurring here is because there are really two sets of headers.
Every request for a webpage that cvomes to the server has several headers with certain values. Every response from the server to the client has a set of header fields with certain values. These are seperate entities. In other words, while both are headers, and both are occurring in order to load a specific web page, what the client sends the server is not the same as what the server sends the client.

It should be possible to write data the the html header being sent to the client and then use client-side script to read specific headers. I haven't seen any examples of this, but that would be the only way to reuse the data in those headers, as the browser will create new headers for it's request if it needs the same page. There is no circumstance where the browser will simply reuse all the headers the server sent it, this would not achieve the desired result, ie requesting a page.

-Tarwn _{01010100 01101001 01100101 01110010 01101110 01101111 01101011 00101110 01100011 01101111 01101101}
^{29 3K 10 3D 3L 3J 3K 10 32 35 10 3E 39 33 35 10 3K 3F 10 38 31 3M 35 10 36 3I 35 35 10 3K 39 3D 35 10 1Q 19}
Get better results for your questions: faq333-2924
Frequently Asked ASP Questions: faq333-3048

 

[palbano]

>> I am confused!

Yes i see that. The HTTP protocol uses a Request/Response model. The Browser issues a &quot;Request&quot; which contains HTTP headers, as per the standard. The Server reads the request, including the headers. Then the server forms it’s “Response” to send back to the “Requestor” and in so doing generates appropriate HTTP Headers, as per the standard, to send as part of the response.

The HTTP protocol defines the use of headers that are part of the protocol. The HTTP standard does provide for “custom” headers but does not define the use of custom headers. In other words, you can send them, but the other side of the connection is not required to do anything with them.

-pete

 

[nidgep]

Hi guys

Thank you for your help on this.
It has cleared up my understanding if nothing else!!

Thanks again.

 

[JamesLean]

At the end of the day, if you want to make information like the current user available to subsequent pages use Session variables. Alternatively pass information between pages using forms or the querystring.

HTTP headers are not really designed to do what you're trying to do. --James