0

To elaborate, HTTP basic auth is pretty straightforward - we can skip that. Auth with client certs is cumbersome and unpopular - skip that too. What I am really interested in is:

  1. With form-based auth, how does the browser know which HTML page contains fields for credentials, and how does it know which fields to look for?
  2. When Oauth is required, how does the browser know that?
  3. Are there any custom authentication schemes which browser learns on the fly, as it interacts with the page? If so, how does it learn?
2
  • 2
    The browser does not detect anything, the server requires an authentication method, and the browser implements it, or fails. – ThoriumBR Mar 1 '20 at 18:35
  • To be a bit more specific: with authentication by client certificates the server sends a CertificateRequest, with basic authentication the server sends a response with code 401 and an WWW-Authenticate header, in other cases the server sends a HTML page which includes a form with fields for username and password etc - i.e. the browser just executes what is requested by the server. – Steffen Ullrich Mar 1 '20 at 18:44
2
  1. With form-based auth, how does the browser know which HTML page contains fields for credentials, and how does it know which fields to look for?

The browser does not know and the browser does not need to know. The server is sending a HTML document with a form and which form fields have which kind of meaning is known to the server. The browser is just rendering the HTML document and displaying the form according to the HTML standard. The user is filling in the information into the displayed form. Any local handling will be done according to the HTML standard (like not displaying the password in fields of type "password") and maybe some Javascript which was also provided by the server. The browser then submits the filled in form to the server and the server will know which field names contain which kind of information, i.e. where to look for username, password etc.

  1. When Oauth is required, how does the browser know that?

The server will issue the necessary redirects if it wants the client to authenticate. Please have a look at how the communication flow works with Oauth yourself for the details.

  1. Are there any custom authentication schemes which browser learns on the fly, as it interacts with the page?

No. The browser does not "learn". The browser gets instructions on what to do and what to display. The logic is implemented server side and/or in Javascript provided by the server but running inside the browser as part of the rendered document.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.