updae:
ich habe jetzt einen Code zusammengebastelt, der einigermaßen, aber noch nicht 100%ig funktioniert.
Fürs erste teste ich nur aufs Passwort wegen der Debug-Phase.
ist es völlig falsch, wird es zurückgewiesen, ist es 100% richtig, dann auch angenommen.

Problem aber:
wenn das Pwd zB "12345" ist, und der usr gibt "1234567" ein, wird es auch akzeptiert. Ich kriege nicht raus, wo der Fehler liegt.
Wer weiß wo der Hase im Pfeffer liegt?

Hier erst mal 2 Hilfsfunktionen, um Passwort etc. aus dem html-String rauszufischen (funktioniert ansonsten einwandfrei):

Code:
int16_t  strstrpos(char * haystack,  char * needle)   // find 1st occurance of substr in str
{
   char *p = strstr(haystack, needle);
   if (p) return p - haystack;
   return -1;   // Not found = -1.
}

//----------------------------------------------------------------------------
const int  MAXLEN = 1024;
const int  TOKLEN = 64;

char * cstringarg( char* haystack, char* vname, char* sarg ) {
   int i=0, pos=-1;
   unsigned char  ch=0xff;
   char  kini[3] = "&";       // start of varname: '&': 
   char  kequ[3] = "=";       // end of varname, start of argument: '='
   char  needle[TOKLEN]="";   // complete pattern:  &varname=abc1234

   //kequ[0] = '=';  // customize
   strcpy(sarg,"");
   strcpy(needle, kini);
   strcat(needle, vname);
   strcat(needle, kequ);
   pos = strstrpos(haystack, needle); 
   if(pos==-1) return sarg;
   pos=pos+strlen(vname)+2; // start of value = kini+vname+kequ   
   while( (ch!='&')&&(ch!='\0') ) {
      ch=haystack[pos+i];    
      if( (ch=='&')||(ch==';')||(ch==' ')||(ch=='\0') ||(ch=='\n')
        ||(i+pos>=strlen(haystack))||(i>TOKLEN-1) ) {
           sarg[i]='\0';
           return sarg;
      }       
      if( (ch!='&') ) {
          sarg[i]=ch;          
          i++;       
      }      
   } 
   return sarg;
}
und hier jetzt die eigentliche Website, die username und passwort anfordert zum Login:

Code:
char  website_uname[20]="abcde"; //  website user name 
char  website_upwd[20]="12345"; // website user pwd 

void handleNotAuthorized() {
  String readString="";
  char   strinput[MAXLEN], strupwd[TOKLEN], struname[TOKLEN];

  WiFiClient client = wifiserver.available();

  //---------------------------------------

  strcpy(strinput, "");
  strcpy(strupwd, "");
  strcpy(struname, "");

  while ( client.connected() ) {
    if (authorized) return;
    
    readString.toCharArray(strinput, MAXLEN);

    // cstringarg( char* haystack, char* vname, char* sarg )
    // haystack pattern: &varname=1234abc,  delimiters &, \n, \0, SPACE, EOF
    cstringarg(strinput, "uname", struname);  // uname
    cstringarg(strinput, "upwd", strupwd);   // upwd    

    if ( strlen(strupwd) == strlen(website_upwd)
         && strcmp(strupwd, website_upwd ) == 0)   {
      authorized = true;
      readString = "";
      return;
    }

    if ( client.available() ) {
      char c = client.read();

      //read char by request
      if (readString.length() < TOKLEN) {

        //store characters to string
        readString += c;
        //Serial.print(c);
      }

      //if HTTP request has ended
      if (c == '\n') {
        client.flush();
        Serial.println(readString);

        //now output html data header

        String script = "";

        script += ("HTTP/1.1 401 Log-In Required");
        script += ("Content-Type: text/html \n");
        script += ("\n");  //  do not forget this one //????
        script += ("<!DOCTYPE html> \n");
        script += ("<html> \n");
        script += ("<head> \n");


        // utf-8 für "°" Zeichen
        script +=  "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\"> \n" ;
        script +=  "<title>" ;
        script +=  website_title ;
        script +=  "</title> \n" ;
        script +=  "</head> \n" ;
        script +=  "<body> \n" ;

        script += "<h1><p style=\"color:rgb(255,0,191);\"> " + (String)website_url ;
        script += (String)": &nbsp; <wbr> <wbr> " + "Not authorized !</p> </h1> \n" ;
        script += ("<h2><p style=\"color:rgb(255,0,191);\"> log in to proceed: </p> </h2> \n");

        script += ("<FORM ACTION='/' method=GET > \n");
        script += ("<h2>user name:  <INPUT TYPE=text NAME='uname' VALUE=''  MAXLENGTH='50'> </h2> \n");
        script += ("<h2>password :  <INPUT TYPE=PASSWORD NAME='upwd' VALUE='' MAXLENGTH='50'> </h2> \n");

        script += ("<h2><INPUT TYPE=SUBMIT></h2> \n");

        script += ("</FORM> \n");
        script += ("<BR> \n");
        script += ("</body> \n");
        script += ("</html> \n");

        client.print(script);

        //stopping client
        client.stop();
        delay(1);

        //clearing string for next read
        readString = "";
      }
    }
    delay(1);
  }
}