Setting anonymous/stealth login to web applications – the HTTPUnit way

public class Processor {

public Processor() {

}

public String getHTML() {

WebConversation conversation = new WebConversation();

WebRequest req = new GetMethodWebRequest(“http://www.abc.com/login”);

try {

HttpUnitOptions.setScriptingEnabled(true);

HttpUnitOptions.setExceptionsThrownOnScriptError(false);

WebResponse res = conversation.getResource(req);

WebForm form = res.getForms()[0];

String formName = form.getName();

form.setParameter(“user”, “test”);

form.setParameter(“password”, “pwd”);

WebResponse formResponse = form.submit();

String htmlText = formResponse.getText();

return htmlText;

} catch (IOException e) {

// TODO Auto-generated catch block

e.printStackTrace();

} catch (SAXException e) {

// TODO Auto-generated catch block

e.printStackTrace();

}

return null;

}

}

I am currently working on setting up Oracle WebCenter/Oracle Weblogic portal for developing a sample application. One of the aspects we need to take care of is provide navigable links to other core as well as support applications. In the production set up all the applications will be hooked up using Single Sign On(SSO), however in the demo version we are not using a SSO setup. Each application has its individual login page. Therefore, while navigating from one application to another, or from the portal to individual application, the user needs to supply security credentials, this is irritating from an user experience point of view.

I am currently working on setting up Oracle WebCenter/Oracle Weblogic portal for developing a sample application. One of the aspects we need to take care of is provide navigable links to other core as well as support applications. In the production set up all the applications will be hooked up using Single Sign On(SSO), however in the demo version we are not using a SSO setup. Each application has its individual login page. Therefore, while navigating from one application to another, or from the portal to individual application, the user needs to supply security credentials, this is irritating from an user experience point of view.

To circumvent the problem, I started looking at ways and means of invoking the page behind the scene. Basically I was looking for the behavior associated with typical web application testing tool. My search lead me to a tool named HTTPUnit. It provides methods to execute HTTP requests and process HTTP responses via Java programs. Here’s the sample program that I created (Note: the package name and package imports have been removed for better comprehension):

1:public class BPMTest {
2:
3:	public static void main(String[] args) {
4:
5:		WebConversation conversation = new WebConversation();
6:		WebRequest req = new GetMethodWebRequest(<HTTP REQUEST URL>);
7:		try {
8:			//HttpUnitOptions.setScriptingEnabled(false);
9:			WebResponse res = conversation.getResource(req);
10:			//String s = res.getText();
11:			//System.out.println(s);
12:			WebForm form = res.getForms()[0];
13:			String formName = form.getName();
14:			String[] params = form.getParameterNames();
15:
16:			for (String paramName : params) {
17:				System.out.println(paramName);
18:			}
19:
20:			form.setParameter("user", <USERNAME>);
21:			form.setParameter("password", <PASSWORD>);
22:			WebResponse formResponse = form.submit();
23:
24:			String s = formResponse.getText();
25:			System.out.println(s);
26:
27:		} catch (IOException e) {
28:			e.printStackTrace();
29:		} catch (SAXException e) {
30:			e.printStackTrace();
31:		}
32:
33:
34:	}
35:
36:}
Running this program in my case generated a error message:

org.mozilla.javascript.EcmaError: TypeError: Cannot find function attachEvent. (httpunit#50)
	at org.mozilla.javascript.ScriptRuntime.constructError(ScriptRuntime.java:3229)
	at org.mozilla.javascript.ScriptRuntime.constructError(ScriptRuntime.java:3219)
	at org.mozilla.javascript.ScriptRuntime.typeError(ScriptRuntime.java:3235)

As I understand it, there are certain Javascript events not supported in HTTPUnit, hence the error. As per Google, the fix is to use HTMLUnit, which apparently provides better support for Javascript. Fortunately, HTTPUnit is configurable, I uncommented line 8 in the code. This allows HTTPUnit’s Javascript processing to be bypassed. The code ran without any errors and I could process the response. However if you are greedy and want HTTPUnit to process as much Javascript as possible do the following. Replace line 8 with the following lines of code:

	HttpUnitOptions.setScriptingEnabled(true);
	HttpUnitOptions.setExceptionsThrownOnScriptError(false);

This enables HTTPUnit Javascript but does not throw any exceptions on encountering errors during Javascript processing.
Let’s understand the features provided by HTTPUnit. The tool provides access to forms within the web page(line 12). One can key in information to the form and submit it(line 20-22). The HTML generated as a response to the form submission is available via the getText method of WebResponse(line 24).

Now to integrate this solution with our requirement. To test this in the web world, I developed a small web application and deployed it on Tomcat server. You will find enough material on the web to set up this configuration. The following are the most important components. The test page test.jsp, the web.xml and Processor code:

CODE for web.xml (for Tomcat server only)

Located within the <application-root>/WEB-INF folder.

<?xml version="1.0" encoding="ISO-8859-1"?>
<web-app xmlns="http://java.sun.com/xml/ns/j2ee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee
    http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd" version="2.4">
  	<servlet>
    	<servlet-name>jsp</servlet-name>
    	<servlet-class>org.apache.jasper.servlet.JspServlet</servlet-class>
    	<init-param>
      		<param-name>fork</param-name>
      		<param-value>false</param-value>
    	</init-param>
    	<init-param>
      		<param-name>xpoweredBy</param-name>
      		<param-value>false</param-value>
    	</init-param>
    	<init-param>
			<param-name>logVerbosityLevel</param-name>
			<param-value>WARNING</param-value>
		</init-param>
		<init-param>
			<param-name>classdebuginfo</param-name>
			<param-value>true</param-value>
		</init-param>
    	<load-on-startup>3</load-on-startup>
  	</servlet>

	<servlet-mapping>
		<servlet-name>jsp</servlet-name>
	    <url-pattern>*.jsp</url-pattern>
	</servlet-mapping>

	<servlet-mapping>
	    <servlet-name>jsp</servlet-name>
	    <url-pattern>*.jspx</url-pattern>
	</servlet-mapping>

	<session-config>
	    <session-timeout>30</session-timeout>
	</session-config>

	<welcome-file-list>
	    <welcome-file>index.html</welcome-file>
	    <welcome-file>index.jsp</welcome-file>
	</welcome-file-list>

</web-app>

CODE for Processor

Located within the <application-root>/WEB-INF/classes folder

public class Processor {

	public Processor() {

	}

	public String getHTML() {
		WebConversation conversation = new WebConversation();
		WebRequest req = new GetMethodWebRequest("http://www.abc.com/login");
		try {
			HttpUnitOptions.setScriptingEnabled(true);
			HttpUnitOptions.setExceptionsThrownOnScriptError(false);
			WebResponse res = conversation.getResource(req);
			WebForm form = res.getForms()[0];
			String formName = form.getName();

			form.setParameter("user", "test");
			form.setParameter("password", "pwd");
			WebResponse formResponse = form.submit();
			String htmlText = formResponse.getText();
			return htmlText;

		} catch (IOException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		} catch (SAXException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		}

		return null;

	}

}

CODE for test.jsp

Located within the <application-root>

<?xml version=”1.0″ encoding=”ISO-8859-1″ ?>

<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
    pageEncoding="ISO-8859-1"%>
<jsp:useBean id="proc" class="com.test.Processor" scope="page"/>

<%
	out.println(proc.getHTML());
%>

Running the test.jsp displays the response page generated on submitting login information to the http://www.abc.com/login URL. However there are certain limitations,

1. The Javascript support is not extensive. If the page is largely dependent on Javascript for its display then you may have problems.
2. As a best practice, URLs in web pages are relative, this causes the resultant page displaying URLs relative to your tomcat server and not www.abc.com server. Therefore, the web application would need to be deployed on the individual remote application and not at a single separate location.

As a part of this dependant jar libraries, it provides a servlet-api-2.4.jar, ensure that this jar is not deployed in the WEB-INF/lib folder. I might try HTMLUnit to check its Javascript support. More on that later.

---

Possibly related posts: (automatically generated)

• Why You Need To Secure Your Web Applications?
• Web Development – The Next Level