Weak auth page doesn't use weak auth

[kingthorin]

https://github.com/sectooladdict/wavsep/blob/master/WebContent/passive/session/weak-authentication-basic.jsp
Doesn't use basic auth.

If server configuration is app server dependant then the necessary headers could be "faked" through use of response.setHeader(headerName, headerValue)

https://en.m.wikipedia.org/wiki/Basic_access_authentication#Server_side

[sectooladdict]

Its actually a ZAP-WAVE test case.
Note taken, will fix or remove in future versions.
https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail
This
email has been sent from a virus-free computer protected by Avast.
www.avast.com
https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail
<#DDB4FAA8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

On Wed, Dec 30, 2015 at 2:39 PM, kingthorin [email protected]
wrote:

https://githubcom/sectooladdict/wavsep/blob/master/WebContent/passive/session/weak-authentication-basicjsp
Doesn't use basic auth

If server configuration is app server dependant then the necessary headers
could be "faked" through use of responsesetHeader(headerName, headerValue)

https://enmwikipediaorg/wiki/Basic_access_authentication#Server_side

—
Reply to this email directly or view it on GitHub
#6.

[kingthorin]

I'll look into putting something together.

[kingthorin]

Hi @sectooladdict the following should be sufficient to "fake" the issue:

    <% response.setStatus(401); %>
    <% response.setHeader("WWW-Authenticate", "Basic realm=\"test realm:\""); %>

If you want an actual contribution via Pull Request let me know.

[sectooladdict]

Got it, 10x
On Feb 9, 2016 4:01 AM, "kingthorin" [email protected] wrote:

Hi @sectooladdict https://github.com/sectooladdict the following should
be sufficient to "fake" the issue:

<% response.setStatus(401); %>
<% response.setHeader("WWW-Authenticate", "Basic realm=\"test tealm:\""); %>

If you want an actual contribution via Pull Request let me know.

—
Reply to this email directly or view it on GitHub
#6 (comment).