30

When I go to a place with a WiFi hotspot (such as Panera Bread) and connect with my iPhone, the hotspot login page appears as a popup. That is, no matter what app I'm running or what web page I'm on, the login page scrolls up from the bottom, asks for my login credentials, and then disappears.

But at some other hotspots, I don't get the login page until I go to Safari and try to load a web page.

What is the iPhone looking for that causes it to pop up the login page at some hotspots and not others? Is there a special HTML meta tag? Or is it related to the way the redirect is implemented?

3 Answers 3

37

I managed to find out the correct term for this authentication type: "Captive portal". Punching in Captive Portal iPhone into Google turned out a few technical details from these pages: one, two, three.

To implement a Wi-Fi popup login page:

  1. DNS request for www.apple.com must not fail
  2. HTTP request for http://www.apple.com/library/test/success.html with special user agent CaptiveNetworkSupport/1.0 wispr must not return Success.

I have not tested this, but it sounds about right.


Comments below mention that iOS 7 behaves differently and may query more than one server. I have not tested this. So easiest would be to simply redirect all HTTP communication to your login page, and block all non-HTTP communication.

Microsoft's captive portal detection uses something similar to pre-iOS7 behavior: its Network Connectivity Status Indicator attempts to contact http://www.msftncsi.com. Windows 8 and 8.1 also include support for WISPr.

Android's captive portal detection, as of AOSP 4.0.1, tries to contact http://clients3.google.com/generate_204 or http://www.google.com/blank.html.

So to be as universal as possible, you'll want to simply block all communication except for authentication, and include WISPr support on the login page.

I'd say "go with a proper authentication on your network" -- something universal such as PEAP+MSCHAPv2 -- but Windows makes it very painful for your users to set it up. I don't know who thought that "Use your Windows authentication details" makes a sane default on machines that are not part of a corporate domain network, or even why "Check certificate validity" is a sane default, as most networks will not consider getting a proper certificate a priority.

16
  • Good work! I'll accept your answer, even though I don't have the resources to try it out yet. Sep 13, 2010 at 4:25
  • 1
    Here's an interesting article that goes into more detail: erratasec.blogspot.com/2010/09/apples-secret-wispr-request.html May 6, 2013 at 21:11
  • ios7 doesn't use the following url anymore: apple.com/library/test/success.html. it was replaced by an url on www.ibook.info (ibook.info).
    – sailor
    Aug 22, 2013 at 15:29
  • 2
    @sailor Only partly correct. In IOS7 apple has gone from testing one single page, to more than 200 random sites to see if wifi is open or not. You now need to test for User Agent and not URL.
    – Jotne
    Jan 6, 2014 at 6:51
  • Just wanna add that from Android 5.0.2 on the host has part changed from clients3.google.com to connectivitycheck.android.com. The rest of the URL stayed the same.
    – bk138
    Apr 23, 2015 at 16:13
1

iOS 6 has apparently fixed WPA2 EAP as it's suddenly popping the login window now.

Our companies public WiFi requires accepting the terms regarding monitoring, etc. I always had to manually open Safari on iPhone or iPad and navigate somewhere, it redirects to an internal acceptance page and when you clicked the Accept button it would go where you originally were headed.

Today, I updated to iOS 6 and was plesantly surprised to see the Login window slide up from the bottom and allow me to click the Accept button without even opening Safari.

-4

I suspect that when the login page pops up the Wi-Fi is using EAP. This is a Wi-Fi protocol for authentication. In the case where you need to go to a web page then the authentication will be a custom access implemented by a server (i.e. at a higher level than EAP).

1
  • 2
    Incorrect. I have seen this on one hotspot as well; it's not the typical EAP login dialog. A HTML page is displayed requiring login. It does not seem to even require the request to be via HTTP. The current application is overlaid with the login web page. Sep 12, 2010 at 17:15

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.