Selenium as a Proxy Server
In order to customize the request headers in Selenium you must be using it as a proxy server. Unless you use the
-avoidProxy argument when you start up the Selenium server, it will serve as a proxy server bound to localhost (i.e., it is not an open proxy). You also must use a browser launcher that configures the browser to use the Selenium server as an HTTP proxy. I discuss this in more depth in my article on how to accept self-signed SSL certificates in Selenium.
It is a best practice to only perform basic authentication over HTTPS if you’re accessing publicly accessible pages. If all your work is on an internal network and it’s a trusted environment, basic authentication over HTTP may be acceptable. Just realize that basic authentication is plain text and easily sniffable. If you’re connecting to a server with a self-signed certificate you may want to read the aforementioned article on how to do so with Selenium.
Basic Authentication with Selenium
It probably seems obvious, but you really need to make sure your credentials work. If they don’t, the browser is going to pop up a basic authentication dialog and your Selenium browser session is going to be effectively locked-up. An example of how to do so in Ruby can be seen in Example 1.
Once you’ve verified that your basic authentication credentials do in fact work, you can proceed to add the credentials to your Selenium request. You do so by adding the “Authorization” header with a value of “Basic “ followed by the base 64 encoded “username:password” pair. The browser will cache this value for all requests within the same session, so you only need to authenticate on the first request. Example 2 shows how this looks in Ruby using the selenium-client gem.
Since basic authentication credentials can be supplied as an HTTP request header, you can perform basic authentication with Selenium with a little bit of work. You need to use the Selenium server as a proxy for your browser requests, configure acceptance of self-signed SSL certificates if appropriate, and verify that the credentials work before issuing your request. Once you do so, you’ll be able to test sites without worrying about the browser locking up on the authentication dialog. Note that this article only addresses basic authentication (the most popular of the HTTP authentication methods). Digest authentication is a completely different beast and the method laid out in this article will not work for it.