Some of you seem to confuse Basic authentication with form-based authentication. They’re not the same and the differences are important. If you don’t configure siege for the appropriate authentication method, it will be on the outside looking in at an HTTP-401.
Basic authentication occurs at the protocol level. It was originally described in HTTP/1.0 and later moved to RFC 2617. Basic authentication is a challenge/response framework. When the server receives a request for a protected resource, it challenges the user to authenticate himself. It will make the item available only after the user is autheticated.
Here’s an example exchange using basic.php from the html directory inside the siege source code:
GET /siege/basic.php HTTP/1.0 Host: http://www.joedog.org Accept: */* Accept-Encoding: gzip User-Agent: JoeDog/1.00 [en] (X11; I; Siege 2.71b6) Connection: close
HTTP/1.1 401 Authorization Required Date: Thu, 16 Feb 2012 13:09:53 GMT Server: CERN/1.0A X-Powered-By: PHP/5.2.5 WWW-Authenticate: Basic realm="siege_basic_auth" Status: 401 Unauthorized Content-Length: 178 Connection: close Content-Type: text/html; charset=WINDOWS-1251
GET /siege/basic.php HTTP/1.0 Host: http://www.joedog.org Authorization: Basic c2llZ2U6aGFoYQ== Accept: */* Accept-Encoding: gzip User-Agent: JoeDog/1.00 [en] (X11; I; Siege 2.71b6) Connection: close
HTTP/1.1 200 OK Date: Thu, 16 Feb 2012 13:09:53 GMT Server: CERN/1.0A X-Powered-By: PHP/5.2.5 Content-Length: 278 Connection: close Content-Type: text/html; charset=WINDOWS-1251
See what happened? Siege requested /siege/basic.php and the server was all “Whoa! I don’t know who you are.” It issued an HTTP 401 challenge to siege which responded by sending its username and password in BASE64 encryption:
In this example, I emulated HTTP Basic authentication with a php program. Typically, Basic auth is setup at the server level. Here’s an example in apache:
<Location "/siege"> AuthType basic AuthName "siege_basic_auth" AuthBasicProvider file AuthUserFile /var/www/etc/passwd AuthGroupFile /var/www/etc/group Require valid-user Require group siege Satisfy All </Location>
To configure siege to use basic authetication, you need to add a login to your .siegerc file. Search the file for WWW-Authenticate. The directive is login and it takes three values separated by a colon. username:password:realm. Our
basic.php username and password are ‘siege’ and ‘haha’. So our login looks like this:
login = siege:haha:siege_basic_auth
The third argument (realm) is optional. If you don’t specify a realm, siege will send ‘siege:haha’ every time it faces an HTTP basic challenge. By setting a realm, you can configure it to use multiple logins:
login = admin:secret:Administration login = siege:haha:siege_basic_auth login = root:d41ly:high_level
Now you can also restrict access programmatically. This is referred to as form-based authentication. In order to configure siege to login in this manner, you’ll need to reproduce a browser’s action.
To illustrate this, we’ve included
login.php in the html directory of the siege source code. That page accepts both GET and POST requests. It produced an HTML form that looks like this:
<td>Username: </td><td> <input type='text' name='username' value='' size='30'></td> <td>Password: </td><td> <input type='password' name='password' value='' size='30'></td>
To login to this form, you’ll need to provide field values that match the form. Your parameters must match the form input names. In this case it’s ‘username’ and ‘password’.
http://my.server.com/login.php?username=siege&password=haha http://my.server.com/login.php POST username=siege&password=haha
If your entire site requires authentication you can add a login URL to your .siegerc file. If this value is set, siege will access that URL before it does anything. Search your .siegerc file for ‘login-url’. Here’s an example using one of the URLs we constructed above:
login-url = http://my.server.com/login.php POST username=siege&password=haha
After it hits that URL, siege will start running through the list of URLs you created.