The flow is like this.
- Client sends GET to Server
- Server responds with 401 UNAUTHORIZED and the authentication protocol: NTLM
- Client re-sends the request including authentication information.
I don't get it. What exactly does the client send at step 3? The password? And if yes, what encoding does it use? The username should be sent in plain text and I don't see it. Here are the HTTP headers:
- GET http://example.com
- HTTP/1.1 401 Unauthorized. WWW-Authenticate: Negotiate. WWW-Authenticate: NTLM
- GET http://example.com Security: Authorization: Negotiate YIIPQwYGKwYBBQUCoIIPNzCCDzOgMDAuBgkqhki...UMVM=
At step 3 I've cut part of text because it was way too long.