Indy Http (TidHttp) and logout with Lighttpd lazarus / 38-Networking and Web Programming ---------------------------------------------------------------------- BSaidus · 2022-11-12 20:13 Hello. Given Lighttpd webserver with php installed and configured as cgi. the Lighty is also configured with simple authentification (user:password). Since Http protocol is state less, I wonder if I send a request with Indy IdHttp using login & password in request, once the send operation is done, is the server requests authentification from client for second send ?? Why I ask this, I have to developpe  an application in lazarus using Indy and communicating with lighttpd where there is php scripts. using IdHttp to send data and receive response as json from server. thank you. ---------------------------------------------------------------------- PierceNg · 2022-11-13 03:18 Quote from: BSaidus on November 12, 2022, 09:13:50 pmHello. Given Lighttpd webserver with php installed and configured as cgi. the Lighty is also configured with simple authentification (user:password). Since Http protocol is state less, I wonder if I send a request with Indy IdHttp using login & password in request, once the send operation is done, is the server requests authentification from client for second send ?? If Lighty is configured using HTTP Basic Authentication, then what happens is: - First time your web browser connects, the browser pops up a dialog box prompting username and password. - Browser remembers what you entered. - Browser sends your credentials on every request. Here's MDN reference material on basic authentication. However, there exist many many ways of doing web authentication. The ways that don't use Basic Authentication will typically have a login form on a web page. So it really depends on how exactly your Lighty server and/or PHP application are doing it. ---------------------------------------------------------------------- BSaidus · 2022-11-14 09:13 @PierceNg Thank you for your enlightements. I have some scripts on server written in php, and the folder is protected with basic-authentification schema. So I think that it is good way for me to add SSL/TLS for lighty and stay with basic_auth after knowing this Quote- Browser remembers what you entered. - Browser sends your credentials on every request. This mean, I must Always send credential in every request using Indy Http. Thank you. ---------------------------------------------------------------------- Remy Lebeau · 2022-11-14 22:40 Quote from: BSaidus on November 12, 2022, 09:13:50 pmSince Http protocol is state less, I wonder if I send a request with Indy IdHttp using login & password in request, once the send operation is done, is the server requests authentification from client for second send ?? It might, yes.  Or, it might send you a cookie representing the login session, expecting you to send that cookie back to the server on subsequent requests (TIdHTTP will handle that for you if its AllowCookies property is True, which it is by default).  It depends on how the server is setup to operate. You can optionally set credentials on a request before sending it.  Or, you can wait for the server to ask for credentials.  TIdHTTP will fire its On(Select)Authorization events whenever the server asks for new credentials during a request. ---------------------------------------------------------------------- BSaidus · 2022-11-16 19:55 Quote from: Remy Lebeau on November 14, 2022, 11:40:09 pmQuote from: BSaidus on November 12, 2022, 09:13:50 pmSince Http protocol is state less, I wonder if I send a request with Indy IdHttp using login & password in request, once the send operation is done, is the server requests authentification from client for second send ?? It might, yes.  Or, it might send you a cookie representing the login session, expecting you to send that cookie back to the server on subsequent requests (TIdHTTP will handle that for you if its AllowCookies property is True, which it is by default).  It depends on how the server is setup to operate. You can optionally set credentials on a request before sending it.  Or, you can wait for the server to ask for credentials.  TIdHTTP will fire its On(Select)Authorization events whenever the server asks for new credentials during a request. Thank you for this, I'll try it, I use php scripts in the server side. With php I can manage cookies. ---------------------------------------------------------------------- BSaidus · 2022-11-16 19:56 Thank you all guys, for your responses. ---------------------------------------------------------------------- BSaidus · 2022-11-21 12:35 Hi @Remy Lebeau Could you please if, you have an example using "IdHttp" and "IdCookieManager", or pointing me to an example in the internet. Thank you. ---------------------------------------------------------------------- paweld · 2022-11-21 13:10 Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i uses  IdHTTP, IdCookieManager, IdSSLOpenSSL, IdGlobal, IdURI; var  ih: TIdHTTP;  ihssl: TIdSSLIOHandlerSocketOpenSSL;  icm: TIdCookieManager; procedure TForm1.FormCreate(Sender: TObject);var  i: Integer;begin  ih := TIdHTTP.Create;  ih.HandleRedirects := True;  ihssl := TIdSSLIOHandlerSocketOpenSSL.Create;  ihssl.SSLOptions.Method := sslvSSLv23;  ihssl.SSLOptions.SSLVersions := [sslvSSLv23];    ih.AllowCookies := True;  icm := TIdCookieManager.Create;  ih.IOHandler := ihssl;  ih.CookieManager := icm;  ih.Get('https://lazarus.freepascal.org');  for i := 0 to icm.CookieCollection.Count - 1 do    Memo1.Lines.Add(icm.CookieCollection.Cookies[i].CookieText);end; ---------------------------------------------------------------------- BSaidus · 2022-11-21 15:10 Quote from: paweld on November 21, 2022, 02:10:51 pmCode: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i uses  IdHTTP, IdCookieManager, IdSSLOpenSSL, IdGlobal, IdURI; var  ih: TIdHTTP;  ihssl: TIdSSLIOHandlerSocketOpenSSL;  icm: TIdCookieManager; procedure TForm1.FormCreate(Sender: TObject);var  i: Integer;begin  ih := TIdHTTP.Create;  ih.HandleRedirects := True;  ihssl := TIdSSLIOHandlerSocketOpenSSL.Create;  ihssl.SSLOptions.Method := sslvSSLv23;  ihssl.SSLOptions.SSLVersions := [sslvSSLv23];    ih.AllowCookies := True;  icm := TIdCookieManager.Create;  ih.IOHandler := ihssl;  ih.CookieManager := icm;  ih.Get('https://lazarus.freepascal.org');  for i := 0 to icm.CookieCollection.Count - 1 do    Memo1.Lines.Add(icm.CookieCollection.Cookies[i].CookieText);end; Thank you. ---------------------------------------------------------------------- Remy Lebeau · 2022-11-23 03:30 Quote from: paweld on November 21, 2022, 02:10:51 pmCode: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i var  ...  icm: TIdCookieManager; You don't really need to create a TIdCookieManager manually in most situations, unless you want to share a single TIdCookieManager amongst multiple TIdHTTPs.  Otherwise, TIdHTTP will create a TIdCookieManager internally for itself as long as its AllowCookies property is true. Quote from: paweld on November 21, 2022, 02:10:51 pmCode: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i ihssl.SSLOptions.Method := sslvSSLv23;ihssl.SSLOptions.SSLVersions := [sslvSSLv23]; Don't do this. The Method and SSLVersions properties are mutually exclusive, setting one updates the other.  But Method is deprecated, use only SSLVersions.  But don't set SSLVersions to sslvSSLv23, as that will enable every SSL/TLS version supported, from SSL v2.0 up to TLS v1.2.  Never enable the SSL's, as they are no longer secure and nobody uses them anymore.  Only enable the TLS's. Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i ihssl.SSLOptions.SSLVersions := [sslvTLSv1, sslvTLSv1_1, sslvTLSv1_2]; Quote from: paweld on November 21, 2022, 02:10:51 pmCode: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i Memo1.Lines.Add(icm.CookieCollection.Cookies[i].CookieText); The TIdCookie.CookieText property is deprecated, use the TIdCookie.ServerCookie property instead. ---------------------------------------------------------------------- paweld · 2022-11-23 06:06 @Remy Lebeau: Thank you very much for useful information. ---------------------------------------------------------------------- BSaidus · 2022-11-23 11:25 @Remy Lebeau. Thank you, you are the best !