我正在尝试使用Apache HttpClient Java库对使用基于表单的身份验证的网站(例如，facebook.com)进行身份验证。
使用此网站的程序作为主要示例:http://www.elitejavacoder.com/2013/10/http-client-form-based-authentication.html，我能够做到这一点-但有些事情我对该程序不了解。这是代码:

package com.elitejavacoder.http.client;

import java.util.ArrayList;
import java.util.List;

import org.apache.http.HttpEntity;
import org.apache.http.HttpHost;
import org.apache.http.HttpResponse;
import org.apache.http.NameValuePair;
import org.apache.http.client.entity.UrlEncodedFormEntity;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.client.params.ClientPNames;
import org.apache.http.impl.client.DefaultHttpClient;
import org.apache.http.message.BasicNameValuePair;
import org.apache.http.util.EntityUtils;

public class HttpClientFormAuthentication {
    public static void main(String[] agrs) {
        String host = "yourhostname.com";
        int port = 8080;
        String protocol = "http";

        DefaultHttpClient client = new DefaultHttpClient();

        try {
            HttpHost httpHost = new HttpHost(host, port, protocol);
            client.getParams().setParameter(ClientPNames.DEFAULT_HOST, httpHost);

            HttpGet securedResource = new HttpGet("/secured/index.jsp");            
            HttpResponse httpResponse = client.execute(securedResource);
            HttpEntity responseEntity = httpResponse.getEntity();
            String strResponse = EntityUtils.toString(responseEntity);
            int statusCode = httpResponse.getStatusLine().getStatusCode();
            EntityUtils.consume(responseEntity);

            System.out.println("Http status code for Unauthenticated Request: " + statusCode);// Statue code should be 200
            System.out.println("Response for Unauthenticated Request: \n" + strResponse); // Should be login page
            System.out.println("================================================================\n");

            HttpPost authpost = new HttpPost("/j_security_check");
            List<NameValuePair> nameValuePairs = new ArrayList<NameValuePair>();
            nameValuePairs.add(new BasicNameValuePair("j_username", "yourusername"));
            nameValuePairs.add(new BasicNameValuePair("j_password", "yourpassword"));
            authpost.setEntity(new UrlEncodedFormEntity(nameValuePairs));

            httpResponse = client.execute(authpost);
            responseEntity = httpResponse.getEntity();
            strResponse = EntityUtils.toString(responseEntity);
            statusCode = httpResponse.getStatusLine().getStatusCode();
            EntityUtils.consume(responseEntity);

            System.out.println("Http status code for Authenticattion Request: " + statusCode);// Status code should be 302
            System.out.println("Response for Authenticattion Request: \n" + strResponse); // Should be blank string
            System.out.println("================================================================\n");

            httpResponse = client.execute(securedResource);
            responseEntity = httpResponse.getEntity();
            strResponse = EntityUtils.toString(responseEntity);
            statusCode = httpResponse.getStatusLine().getStatusCode();
            EntityUtils.consume(responseEntity);

            System.out.println("Http status code for Authenticated Request: " + statusCode);// Status code should be 200
            System.out.println("Response for Authenticated Request: \n" + strResponse);// Should be actual page
            System.out.println("================================================================\n");
        }
        catch (Exception ex) {
            ex.printStackTrace();
        }
    }
}

最佳答案

/j_security_check是一种表单操作，因此容器知道此请求是用于身份验证的，并且容器可以处理该请求。 /j_security_check是用于提交特定于Enterprise Java应用程序服务器的身份验证表单的Web地址。
j_username和j_password是用于提交用户名和密码的请求参数的名称。这三个名称应以这种方式命名(即j_security_check，j_username和j_password)，以便容器将该请求作为身份验证请求进行处理，并且它可以从提交的请求中检索所需的信息(即用户名和密码)。

作者知道他/她需要使用/j_security_check，因为他/她假设自己正在针对J2EE应用服务器进行身份验证。这不是一个很好的假设。注意端口设置为8080吗？这是Java服务器(例如Tomcat)通常使用的端口，因此它们不会与HTTP服务器上的端口80冲突。

第47行的strResponse包含登录请求本身的内容(没有内容)，第57行的strResponse包含 protected 页面的内容。这是分割:

如果在Web浏览器中执行此操作，则会发生以下情况。

关于java - 使用HttpClient的基于表单的身份验证-j_security_check，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/24455484/