0

Our university uses Microtik devices and a 3rd party application to manage our access to web and internet services. When I open browser in my desktop or connect to a wi-fi access point, it prompt that you should sign in to access network. Like something shown below:

enter image description here

When I click the prompt in mobile phone it shows up a web page and it requests for my account information and after a successful login, I can access Internet.

I want to know what is the name/type of protocol used for this authentication/authorization mechanism which lead to such a pop-up in browser?

You can ignore below part but your answer would be welcome: Besides I want to know are there any software or configuration which can skip user name/password prompt and authenticate automatically under windows or android or there are no any?

Improve this question
4
  • @AndrolGenhald If you would like to answer the question, please post an answer.
    – Philipp
    Feb 22, 2019 at 16:27
  • The way it works is your browser tries to retrieve a known resource when you switch networks, and if it gets something unexpected it pops up the alert to get you to go to the captive portal login.
    – Polynomial
    Feb 22, 2019 at 16:27
  • 1
    @AndrolGenhald There actually is an RFC for that since 2015.
    – Philipp
    Feb 22, 2019 at 16:48
  • @Philipp And that's why I didn't answer, I didn't have time to do the research and I figured at least giving OP the name was better than nothing. Glad to know there's actually a standard way to do it now instead of hijacking DNS.
    – AndrolGenhald
    Feb 22, 2019 at 17:02

1 Answer 1

Reset to default
2

This technique is called a Captive Portal.

There actually is an RFC standard for this since 2015. This RFC extends the DHCP and IPv6 RA protocols to inform the client about the URL of the captive portal as soon as it connects to the network. But this method is not yet very widely used. I am not even sure how widely it is supported by end devices (it would need support from both the operating system and the web browser). The usual procedure is to do it with a HTTP redirect like this:

  1. When you connect to the WiFi network, the router (acting as a DHCP server) gives you an IP address. But that IP address gets marked as "unauthenticated" by the router.
  2. When an "unauthenticated" IP address makes a http or https request to an external website, that request gets intercepted. The router replies with a redirect to the login page. Depending on your browser's security settings, this might generate the "Your connection is not secure" error on HTTPS requests, because the reply doesn't come from the website it is supposed to come from.
  3. When you enter your login credentials, your IP address gets marked as "authenticated" and can now access websites normally.

The "You must log in to the network" below the address bar is a special feature of Firefox called "Captive Portal Detection". It works by requesting the URL http://detectportal.firefox.com/success.txt and comparing the response with the expected one. If the browser receives a redirect or a login form instead, it assumes that the user is blocked by a captive portal.

Are there any software or configuration which can skip user name/password prompt and authenticate automatically under windows or android

I don't know any, but if you use the same wifi regularly, then you could do it with a little shell script which uses wget to POST your login credentials directly to the captive portal URL. But you would need to write this specifically for each network, because the login URL and the POST fields will be different.

Improve this answer
4
  • Thank your for your complete answer. I want to bypass login page by using tools such that I can save my account information inside that tool and that tool pass login info to web server and I can login without wast of time. This is my intention and I'm not looking for tool which do MAC spoofing.
    – VSB
    Feb 22, 2019 at 17:00
  • 1
    The browser in the screenshot in the question is Firefox, the Captive Portal detector of which is open source, unless you're saying it's in Chromium, which is also open source
    – cat
    Feb 23, 2019 at 2:42
  • The shown prompt is not a feature of Google Chrome since this is Firefox. Firefox detects a captive portal by trying to access http://detectportal.firefox.com/success.txt and compare the result with the expected one. And in case you are using Chrome: this is no trade secret as claimed but part of the public available source code of chromium and works the same way as it is described for ChromiumOS: chromium.org/chromium-os/chromiumos-design-docs/…
    – Steffen Ullrich
    Feb 26, 2019 at 16:18
  • @SteffenUllrich Answer updated.
    – Philipp
    Feb 26, 2019 at 16:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .