1

When I login and logout of a particular website: https://worldcat.authn.worldcat.org/login/manageduser-ui/cmnd/useraction/login?acsURL=https%3A%2F%2Fauthn.sd00.worldcat.org%2Fwayf%2Fmetaauth-ui%2Fcmnd%2Fprotocol%2Facs%2Fsaml2&controllerMethod=samlpost (it's the login page for oclc.org/developer), this is the sequence of HTTP requests:

For login:

enter image description here

I am using Charles Proxy.

I don't see my login information being passed. And I see that at the end of each login/logout, there is a POST request being made with a bunch of rubbish characters in the entity body. For example, this is the POST request from the login:

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: ocspd/1.0
Content-Length: 88
Content-Type: application/ocsp-request
Connection: close

0V0T �0M0K0I0   +�_¦zµ'5ÎC£Ç
a1aÕ/(çF8´,áÆÙâ6
¥Þ$QèÖ~èÏ

I am trying to understand how this technology works. If my login information is not passed in the HTTP requests, or not detected, why, and how else could it have reached the server?

0

You're logging in on an HTTPS website, which means the communication is encrypted. The request you're looking for is actually one of the CONNECT ones, but you won't be able to see its content this way.

You need to configure Charles proxy to man-in-the-middle your HTTPS connection. This will make Charles proxy decrypt the content your browser is sending to show it to you, before reencrypting it and sending it to the original site. Note that, as mentioned on the page I linked, unless you add the Charles CA certificate as trusted, this will show a warning in the browser.

The POST requests you are seeing are actually due to HTTPS. Your browser is contacting the CA that issued the website's certificate, asking it if the certificate is still valid. If you want to understand the POST request you showed, you should read about OCSP and probably find an ASN.1 decoder as that's the request body's format.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.