HTTP proxy based captive portal
View Patent ↗HTTP-Based Captive Portal. Client requests through a device such as an access point or wired connection are routed through a captive portal switch (CPS). If the CPS determines that the client has not been authenticated, the CPS redirects (NATs) the client request to an internal HTTP proxy. The CPS HTTP proxy terminates the client request and opens a connection to a captive portal server. Thus, for an unauthenticated client, any HTTP request will be routed to the captive portal server. When client authentication at the captive portal server completes, the captive portal server returns a success code, such as embedded in a web page delivered to the client. When the CPS recognizes this success code, it disables the NAT for that client, allowing further requests to be passed through the network. The CPS may be hosted in a separate network appliance, or it may be a process hosted in the AP or on another AP in the network, or on a network device such as a controller or switch.
1. A computer-implemented method, comprising:
receiving, at a computing device, a first request for data from a client device via a first connection, wherein the requested data is located on the Internet;
determining whether the client device is authorized to access the Internet;
in response to a determination that the client device is not authorized to access the Internet, terminating the first connection between the computing device and the client device and establishing a second connection between the computing device and a captive portal to send the first request for data received from the client device to the captive portal;
redirecting, by the computing device, the first request for data to the captive portal via the second connection;
receiving, by the computing device, a success message from the captive portal authorizing the client device to access the Internet, wherein the success message indicates that the client device has been authenticated, wherein:
the client device is authenticated when the client device is associated with an agreement for Internet access wherein the agreement includes agreeing to payment in exchange for Internet access;
authentication includes authorization to access the Internet for a limited time and within a geographic area;
in response to receiving the success message, cancelling redirection of requests for data from the client device to the captive portal; and
directing a second request for data from the client device to a network, wherein communication between the client device and the network is run through the captive portal switch.
2. A network device, comprising:
one or more processors;
a non-transitory computer-readable medium containing instructions that, when executed by the one or more processors, cause the one or more processor to:
receive a first request for data from a client device via a first connection, wherein the requested data is located on the Internet;
determine whether the client device is authorized to access the Internet;
in response to a determination that the client device is not authorized to access the Internet, terminate the first connection between the network device and the client device and establish a second connection between the network device and a captive portal to send the request for data received from the client device to the captive portal;
redirect the first request for data to the captive portal via the second connection;
receive a success message from the captive portal authorizing the client device to access the Internet, wherein the success message indicates that the client device has been authenticated, wherein:
the client device is authenticated when the client device is associated with an agreement for Internet access that includes agreeing to terms of use, wherein the agreement includes agreeing to payment in exchange for Internet access;
authentication includes authorization to access the Internet for a limited time and within a geographic area;
in response to receiving the success message, cancel redirection of requests for data from the client device to the captive portal; and
directing a second request for data from the client device to a network, wherein communication between the client device and the network is run through the captive portal switch.
3. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium of a network device, including instructions that, when executed by one or more processors, cause the one or more processors to:
receive a first request for data from a client device via a first connection, wherein the requested data is located on the Internet;
identify the client device, wherein identifying includes determining whether the client device is authorized to access the Internet;
in response to a determination that the client device is not authorized to access the Internet, terminate the first connection between the network device and the client device and establish a second connection between the network device and a captive portal to send the first request for data received from the client device to the captive portal;
redirect the first request for data to the captive portal via the second connection;
receive a success message from the captive portal authorizing the client device to access the Internet, wherein the success message indicates that the client device has been authenticated, wherein:
the client device is authenticated when the client device is associated with an agreement for Internet access that includes agreeing to terms of use, wherein the agreement includes agreeing to payment in exchange for Internet access;
authentication includes authorization to access the Internet for a limited time and within a geographic area;
in response to receiving the success message, cancel redirection of requests for data from the client device to the captive portal; and
direct a second request for data from the client device to a network, wherein communication between the client device and the network is run through the captive portal switch.