PureBasic

HTTP Basic Auth with Secure Strings

Demonstrates how to do HTTP basic authentication using secure strings. PureBasic

IncludeFile "CkHttp.pb"
IncludeFile "CkJsonObject.pb"
IncludeFile "CkSecureString.pb"
IncludeFile "CkCrypt2.pb"

Procedure ChilkatExample()

    success.i = 0

    ; This example requires the Chilkat API to have been previously unlocked.
    ; See Global Unlock Sample for sample code.

    ; Imagine we've previously saved our encrypted login and password within a JSON config file
    ; that contains this:

    ; {
    ;   "http_login": "mCrOmA7mBA7Au9RuJGb9hw==",
    ;   "http_password": "jJtiI9TgErTTpqBz9JtHBw=="
    ; }

    json.i = CkJsonObject::ckCreate()
    If json.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkJsonObject::ckLoadFile(json,"qa_data/passwords/http.json")

    crypt.i = CkCrypt2::ckCreate()
    If crypt.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ; These are the encryption settings we previously used to encrypt the credentials within the JSON config file.
    CkCrypt2::setCkCryptAlgorithm(crypt, "aes")
    CkCrypt2::setCkCipherMode(crypt, "cbc")
    CkCrypt2::setCkKeyLength(crypt, 128)
    CkCrypt2::ckSetEncodedKey(crypt,"000102030405060708090A0B0C0D0E0F","hex")
    CkCrypt2::ckSetEncodedIV(crypt,"000102030405060708090A0B0C0D0E0F","hex")
    CkCrypt2::setCkEncodingMode(crypt, "base64")

    ssLogin.i = CkSecureString::ckCreate()
    If ssLogin.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ssPassword.i = CkSecureString::ckCreate()
    If ssPassword.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ; Decrypt to the secure string.  (the strings will still held in memory encrypted, but are now encrypted using
    ; a randomly generated session key.)
    CkCrypt2::ckDecryptSecureENC(crypt,CkJsonObject::ckStringOf(json,"http_login"),ssLogin)
    CkCrypt2::ckDecryptSecureENC(crypt,CkJsonObject::ckStringOf(json,"http_password"),ssPassword)

    http.i = CkHttp::ckCreate()
    If http.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ; Cause the "Authorization: Basic ..." header to be added to HTTP requests
    ; by setting the Login and Password properties.  However, instead of setting the password property
    ; directly, set it via the SetPassword method using the secure string.
    CkHttp::setCkLogin(http, CkSecureString::ckAccess(ssLogin))
    CkHttp::ckSetSecurePassword(http,ssPassword)

    ; Also indicate that Basic authentication is to be used..
    CkHttp::setCkBasicAuth(http, 1)

    ; Do an HTTP GET w/ Basic authentication.
    ; REMEMBER: Always use TLS with Basic authentication.  Otherwise your credentials are exposed for the world to see..

    responseStr.s = CkHttp::ckQuickGetStr(http,"https://www.chilkatsoft.com/helloWorld.html")

    ; Show the request header we sent in the QuickGetStr:
    Debug CkHttp::ckLastHeader(http)

    ; The LastHeader looks something like this:

    ; GET /helloWorld.html HTTP/1.1
    ; Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    ; Connection: keep-alive
    ; User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0
    ; Accept-Language: en-us,en;q=0.5
    ; Authorization: Basic bXlIdHRwTG9naW46bXlIdHRwUGFzc3dvcmQ=
    ; Accept-Encoding: gzip
    ; Host: www.chilkatsoft.com


    CkJsonObject::ckDispose(json)
    CkCrypt2::ckDispose(crypt)
    CkSecureString::ckDispose(ssLogin)
    CkSecureString::ckDispose(ssPassword)
    CkHttp::ckDispose(http)


    ProcedureReturn
EndProcedure