HotSpot · Topic 2 of 5

HotSpot Login Methods

Compare the RouterOS HotSpot login methods: HTTP PAP, HTTP CHAP, HTTPS, MAC, cookie and trial, and learn how to choose them with the login by setting.

  • 4 min
In a nutshell
  • login-by in the HotSpot profile selects the methods.
  • Several methods can be enabled at once, separated by commas.
  • HTTP PAP sends the password in clear. HTTP CHAP hashes it with a challenge.

What it is

A login method is the way a HotSpot client proves who it is, and you can enable several at once.

The methods differ in how much the user must do and in how safely the password travels. Some need a typed name and password. Others use the device address or a stored cookie, so the user types nothing.

The methods are chosen in the HotSpot server profile with the login-by setting.

Clientopens a pageredirectedLogin pagemethods allowed by the profilechecksRouteruser list or RADIUSallowsInternetsession starts

How it works

The profile lists the methods, and the router tries the ones that fit the client.

Choosing the methods

/ip hotspot profile set hsprof1 login-by=mac,cookie,http-chap

Separate several methods with commas. The router combines them. A client that matches the MAC or cookie method gets in at once, and the others see the login form.

The methods

MethodHow the client logs inNotes
http-papTypes a name and password on the login pageThe password is sent in clear over HTTP.
http-chapTypes a name and password on the login pageThe password is hashed with a challenge before it is sent.
httpsTypes a name and password over a secure connectionNeeds a certificate on the router.
macNothing, the device MAC address is the user nameThe MAC address must exist as a user.
cookieNothing, a stored cookie is presentedThe user must have logged in before.
trialNothing, a trial session is givenGives a limited amount of free access without an account.

HTTP PAP and HTTP CHAP

With PAP, the browser sends the password as typed. Anyone who can see the traffic can read it.

With CHAP, the login page contains a script that hashes the password with a random challenge. The password itself is not sent. CHAP is therefore the safer of the two plain HTTP methods.

HTTPS

HTTPS protects the login form with TLS. It needs a certificate, selected with the ssl-certificate setting of the profile.

/ip hotspot profile set hsprof1 login-by=https ssl-certificate=hotspot-cert

The certificate should match the DNS name of the HotSpot. Otherwise browsers show a warning.

MAC authentication

With the mac method, the router takes the client's MAC address and looks for a user whose name is that address. The password is empty unless you set one.

/ip hotspot user add name=AA:BB:CC:DD:EE:FF profile=default

MAC login suits devices that cannot show a web page, such as printers. A MAC address can be copied by someone else, so it is a convenience rather than strong security.

Cookie login

After a successful login, the router can give the browser a cookie. When the user returns, the cookie is presented and the login is skipped.

The http-cookie-lifetime setting of the profile controls how long the cookie lasts. Cookie login is convenient for returning users. It works only for the same browser.

Trial login

The trial method lets a new user try the service for a limited time without an account. The exact trial limits are set in the HotSpot configuration, and they are not needed for the exam beyond knowing the method exists.

Several methods at once

A profile can enable several methods. A common combination is mac,cookie,http-chap: known devices connect silently, returning users use a cookie, and new users see the form.

Where users come from

All of these methods look up the user in the local user list, or in RADIUS when the profile has use-radius enabled. The next pages cover users and profiles.

What to remember for the exam

Seven facts cover most login method questions.

  • login-by in the HotSpot profile selects the methods.
  • Several methods can be enabled at once, separated by commas.
  • HTTP PAP sends the password in clear. HTTP CHAP hashes it with a challenge.
  • HTTPS needs a certificate chosen with ssl-certificate.
  • With mac, the MAC address is the user name.
  • With cookie, a returning browser is let in without a form.
  • trial gives limited free access without an account.
Exam tip

Use HTTP CHAP or HTTPS for typed passwords, and keep HTTP PAP only for special cases.

Common mistakes

These four errors appear again and again.

Enabling HTTPS without a certificate. The method cannot work until a certificate is selected.

Using PAP and assuming privacy. The password is visible to anyone who can capture the traffic.

Forgetting to add the MAC user. MAC login needs a user whose name is the device MAC address.

Treating MAC login as secure. Addresses can be copied, so use it only for low risk devices.

Watch out

A certificate that does not match the HotSpot DNS name makes browsers show a warning, and many users stop there.

Check yourself

Work through these three questions.

  • Which setting chooses the login methods?

    The login-by setting of the HotSpot server profile.

  • What is the difference between HTTP PAP and HTTP CHAP?

    PAP sends the password in clear. CHAP hashes it with a challenge before sending it.

  • How does MAC login identify the user?

    The device MAC address is used as the user name, so a user with that name must exist.

Topic 2 of 5 in HotSpot

Test yourself on HotSpot

The full MikroTik MTCUME question bank has 482 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.