[FIXED] How do I extract the username and password out of a URL in a servlet filter?

Issue

I've created a BasicAuthFilter and it has this signature:

@Override
public void doFilter(ServletRequest request,
                     ServletResponse response,
                     FilterChain chain) throws IOException, ServletException 

This is working if someone calls the filter with an Authorization header set the right way. But, if someone on chrome or firefox visits the url like this:

http://username:password@localhost:8888

The browsers are not populating the Authorization header with that information (which surprised me). I looked at the information sent by chrome and the username and password are in the request URL but nowhere else.

I can't figure out how to extract that information from the URL. I've tried a lot of getters on the HttpServletRequest, but haven't found anything that gives me the username and password.

NOTE: Yes, I know this is insecure, it's just really convenient to use when you're trying to test your system.

Solution

My coworker found this thread that implies this isn't possible in modern browsers. They refuse to send the username:password part of a url over the wire for security reasons.

Answered By - Daniel Kaplan