PowerBuilder

HTTP Basic Auth with Secure Strings

Demonstrates how to do HTTP basic authentication using secure strings. PowerBuilder

integer li_rc
integer li_Success
oleobject loo_Json
oleobject loo_Crypt
oleobject loo_SsLogin
oleobject loo_SsPassword
oleobject loo_Http
string ls_ResponseStr

li_Success = 0

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// Imagine we've previously saved our encrypted login and password within a JSON config file
// that contains this:

// {
//   "http_login": "mCrOmA7mBA7Au9RuJGb9hw==",
//   "http_password": "jJtiI9TgErTTpqBz9JtHBw=="
// }

loo_Json = create oleobject
li_rc = loo_Json.ConnectToNewObject("Chilkat.JsonObject")
if li_rc < 0 then
    destroy loo_Json
    MessageBox("Error","Connecting to COM object failed")
    return
end if
loo_Json.LoadFile("qa_data/passwords/http.json")

loo_Crypt = create oleobject
li_rc = loo_Crypt.ConnectToNewObject("Chilkat.Crypt2")

// These are the encryption settings we previously used to encrypt the credentials within the JSON config file.
loo_Crypt.CryptAlgorithm = "aes"
loo_Crypt.CipherMode = "cbc"
loo_Crypt.KeyLength = 128
loo_Crypt.SetEncodedKey("000102030405060708090A0B0C0D0E0F","hex")
loo_Crypt.SetEncodedIV("000102030405060708090A0B0C0D0E0F","hex")
loo_Crypt.EncodingMode = "base64"

loo_SsLogin = create oleobject
li_rc = loo_SsLogin.ConnectToNewObject("Chilkat.SecureString")

loo_SsPassword = create oleobject
li_rc = loo_SsPassword.ConnectToNewObject("Chilkat.SecureString")

// Decrypt to the secure string.  (the strings will still held in memory encrypted, but are now encrypted using
// a randomly generated session key.)
loo_Crypt.DecryptSecureENC(loo_Json.StringOf("http_login"),loo_SsLogin)
loo_Crypt.DecryptSecureENC(loo_Json.StringOf("http_password"),loo_SsPassword)

loo_Http = create oleobject
li_rc = loo_Http.ConnectToNewObject("Chilkat.Http")

// Cause the "Authorization: Basic ..." header to be added to HTTP requests
// by setting the Login and Password properties.  However, instead of setting the password property
// directly, set it via the SetPassword method using the secure string.
loo_Http.Login = loo_SsLogin.Access()
loo_Http.SetSecurePassword(loo_SsPassword)

// Also indicate that Basic authentication is to be used..
loo_Http.BasicAuth = 1

// Do an HTTP GET w/ Basic authentication.
// REMEMBER: Always use TLS with Basic authentication.  Otherwise your credentials are exposed for the world to see..

ls_ResponseStr = loo_Http.QuickGetStr("https://www.chilkatsoft.com/helloWorld.html")

// Show the request header we sent in the QuickGetStr:
Write-Debug loo_Http.LastHeader

// The LastHeader looks something like this:

// GET /helloWorld.html HTTP/1.1
// Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
// Connection: keep-alive
// User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0
// Accept-Language: en-us,en;q=0.5
// Authorization: Basic bXlIdHRwTG9naW46bXlIdHRwUGFzc3dvcmQ=
// Accept-Encoding: gzip
// Host: www.chilkatsoft.com


destroy loo_Json
destroy loo_Crypt
destroy loo_SsLogin
destroy loo_SsPassword
destroy loo_Http