title: Updating header with authorization credentials without browser popup (Dropwizard 2.0.x)
body: <p>I try to create a small website with just a few pages using dropwizard. Everyone should be able to access all those pages, but I want to give the possibility to login and a logged in user should have extra possibilities (later on that should be role based). Since it is just a small website I think I want to manage the users in my own database.</p>
  <p>I already succeeded in adding an Authenticator. Actually it is created in a feature that I register on startup, so that I get my dependencies for the DAO injected in the Authenticator. I basically do this like that:</p>
  <pre><code>ctx.register(new AuthDynamicFeature(new BasicCredentialAuthFilter.Builder&lt;MyUserStruct&gt;()
                  .setAuthenticator(authenticator)
                  .setRealm(&quot;MyBasicAuth&quot;)
                  .buildAuthFilter()));
  ctx.register(new AuthValueFactoryProvider.Binder&lt;&gt;(MyUserStruct.class));
  </code></pre>
  <p>To test that the Authenticator is working I gave one of my methods in my resource class the parameter <code>@Auth MyUserStruct pUser</code>. That page no longer reacts as I intend it to be later on, instead that page can only be seen when successfully authenticated. And indeed, if I call that page, then the browser will ask me to enter username and password. After doing so I can access that page, and if I call other pages, that only have <code>@Auth Optional&lt;MyUserStruct&gt;</code>, then they do not have credentials before I did the login, and I get the credentials, once I am logged in. So the Authenticator works as expected.</p>
  <p>Actually I have to say that I am not forced to use any of the technologies I have chosen. So I could chose something else than basic auth. But the only thing I do not want is a technology that uses cookies, so authentication should not store tokens or something else in there. That's why basic auth seems to fit my purpose quite well.</p>
  <p>So far, so good. Now I want to log in by entering username and password somewhere on my page (it would be a part of the page which is the same on all of them). That part has a button so that a login method of my resource can by called, and by returning void I would like to stay on the page where the user entered his data. I think this is what is called form based authentication.</p>
  <p><strong>And here comes my problem</strong>: now that I am in my login method of my resource, how can I do the login? I can verify that the user-password-combination is valid, but what do I have to do to store this information that I'm logged in, that I'm authenticated? I found lots of old threads and blogs from the years 2014 to 2016 or sometimes 2017, and they usually use dropwizard 0.8, sometimes 1.0 and in part the use libraries for this task that haven't been updated in the last 3-5 years. I do not get all those information I found sorted in my head, so I wanted to ask which is the way one should go (these days, using dropwizard 2.0.x).</p>
  <p>Thanks for explaining me some maybe basic things. And maybe someone can point me to some working example, I would really appreciate that. Because I don't have the feeling I'm doing something very exotic.</p>
  <p>I tried things like adding <code>@Context HttpHeaders</code> or <code>@Context ContainerRequestContext</code> to my method. But these seem to be proxies, so when modifying them like</p>
  <pre><code>request.pHttpHeaders.getRequestHeaders().putSingle(HttpHeaders.AUTHORIZATION, &quot;Basic &quot; + base64);
  </code></pre>
  <p>then the next call no longer has this information. So I further found some threads where preferably using a <code>ContainerResponseFilter</code> or maybe a <code>ContainerRequestFilter</code> was suggested. But with that I have two problems. One is, even if I change the http header in there using a hard coded dummy username and password, it still is not there in my next call. And furthermore I do not know how to get the data the user entered, since when looking in the debugger, I cannot find that anywhere in the given requestContext oder responseContext. So I saw the proposed solution of using a method interceptor (AOP). But when looking at that solution I have the feeling, that they use stateful beans and that cannot really work once more people access the website at the same time. So it looks to me like this way with a <code>ContainerResponseFilter</code> is not the right way to go. If it is, I would have to solve both problems: really modify the header and getting access to my method parameters. But searching for a solution while not being convinced that this is the right way to go is not good, so to repeat: it would be great if you could explain me how this kind of problem should be solved.</p>
  <p><strong>UPDATE</strong> I have created a project on github that demonstrates what I would like to do. Maybe you can have a look at it and propose a solution to answer my question:
  <a href="https://github.com/DeveloperClaus/DropwizardAuthDemo.git" rel="nofollow noreferrer">https://github.com/DeveloperClaus/DropwizardAuthDemo.git</a></p>