How does Comcast Xfinity Wi-Fi insert HTML into a web page request?

Question

How does Comcast’s Xfinity Wi-Fi insert an in-page popup when you login from a computer that you’ve logged in with before?

This most commonly happens when the Wi-Fi connection resets. It shows up within the current web page, then goes away after a few seconds. The page doesn’t show any Comcast hostnames. I did notice this CSS file, that went away after reloading the page. It doesn’t show on HTTPS urls, as expected.

http://d5k1a84rm5hwo.cloudfront.net/all-201407312053.css

FYI Xfinity Wi-Fi is the Wi-Fi network that is created and managed by Comcast owned equipment and allows you to connect to a hotspot when you’re away from home.

Answer 1

The technique is known as setting up a “Captive Portal”. The concept as described on that site is simple:

Captive portals allow you to leverage a common browser as a secure authentication device. They also have the potential to allow you to do everything securely via SSL and IPSec and setup per user quality of service rules, and still maintain an open network.

As far as implementation goes, depends on the network management product being used. It is typically handled by a firewall appliance. For example, this site has instructions on how to use Captive Portal settings on NG Firewall:

Captive Portal allows administrators to require network users to log in or accept a network usage policy before accessing the internet. Captive Portal can authenticate users against Untangle's built-in Local Directory, Active Directory (if Directory Connector is installed), or RADIUS. It can be used to set up policies (for Policy Manager) by username (or group name if using Active Directory) rather than IP. While Captive Portal is running, captured machines will be forced to authenticate (or just press OK) on the Captive Portal page before they are able to access the internet.

Ditto with the documentation for pfSense:

The Captive Portal function in pfSense allows you to secure a network by requiring a username and password (or just a click through), entered on a portal page.