What is External Captive Portal?

Definition

An external captive portal is a login page hosted outside the network equipment, on a separate web platform. The controller redirects unauthenticated guests to it, and the portal calls back to authorise the session once the guest logs in. It allows far richer design, data handling and integrations than a portal built into firmware.

The authorisation handshake

The flow has four steps. First, the controller intercepts an unauthenticated device and redirects it to the portal URL, appending parameters that identify the client, the access point and the site. Second, the guest completes the login and consent on the portal. Third, the portal calls the controller's authorisation endpoint with those parameters and a shared secret, requesting that the session be granted, often with a duration or bandwidth limit. Fourth, the controller moves the client to the authorised policy and the portal redirects the guest onward. Every step needs the portal domain in the walled garden, or the guest never sees step two.

What it unlocks

Because the page is a real web application, it can do things firmware cannot: multi-step forms, per-location branding, translations, A/B tested layouts, live validation, CRM writes, marketing automation triggers, and consent records stored in a database you can query and export. It also means one portal can serve many sites and vendors while presenting a single guest database, which is the foundation of multi-location WiFi marketing.

What to get right

Three things cause most of the pain. The walled garden must include the portal domain and every third-party hostname the page loads. The shared secret between portal and controller must be strong and stored securely, since anyone who has it can authorise sessions. And the portal must fail gracefully: if the authorisation call errors, tell the guest something honest and retry rather than leaving them on a spinner. Test the whole flow from a real phone on the real network, not from a laptop already on the wired side.

More in Networking