Using Authentication with Ajax.Request

Question

I currently have a Palm WebOS application that uses an Ajax.Request to connect to a web service using basic authentication. To send the username and password, I simply include it in the url (i.e. http://username:password@ip-address:port/) which works exceedingly well, expect for when the password contains anything other than alphanumeric characters (for example, I had a user email me lately who included an "@" and an "&" in his password, and he wasn't able to connect because the symbols weren't getting parsed properly for the url). Is there any way around sending the credentials in the url so that I can allow users to use something other than just alphanumeric in their passwords?

    var username = cookie.get().servers[this.serverIndex].username;
    var password = cookie.get().servers[this.serverIndex].password;
    this.auth = 'Basic ' + Base64.encode(username + ':' + password);
    var baseUrl = 'http://' + url + ':' + port + '/gui/';
    this.baseUrl = baseUrl;


    var request = new Ajax.Request(this.tokenUrl, {
        method: 'get',
        timeout: 2000,
        headers: {
            Authorization: this.auth
        },
        onSuccess: successFunc,
        onFailure: this.failure.bind(this)
    });

Response is (I removed the url for security reasons):

{"request": {"options": {"method": "get", "asynchronous": true, "contentType": "application/x-www-form-urlencoded", "encoding": "UTF-8", "parameters": {}, "evalJSON": true, "evalJS": true, "timeout": 2000, "headers": {"Authorization": "Basic c3VubW9yZ3VzOmZyb2dneUAlMjY="}}, "transport": {"readyState": 4, "onloadstart": null, "withCredentials": false, "onerror": null, "onabort": null, "status": 401, "responseXML": null, "onload": null, "onprogress": null, "upload": {"onloadstart": null, "onabort": null, "onerror": null, "onload": null, "onprogress": null}, "statusText": "", "responseText": "", "UNSENT": 0, "OPENED": 1, "HEADERS_RECEIVED": 2, "LOADING": 3, "DONE": 4}, "url": ""

score 3 · Accepted Answer · answered Jul 21 '10 at 12:24

3

Send the Basic authentication info with header: http://coderseye.com/2007/how-to-do-http-basic-auth-in-ajax.html

var auth = 'Basic ' + Base64.encode(user + ':' + pass);
Ext.Ajax.request({
    url : url,
    method : 'GET',
    headers : { Authorization : auth }
});

answered Jul 21 '10 at 12:24

Imre L

6,159
24
32

Ok, tried that, and I am getting a 401 error...edited my post with my Ajax.Request call and my response... – Nick DeMayo Jul 21 '10 at 12:40
2

Ok, I got it working! I had to change 'headers' to 'requestHeaders', and everything is working great! Thanks! – Nick DeMayo Jul 21 '10 at 13:06

score 0 · Answer 2 · answered Jul 21 '10 at 12:03

0

You could try to encode the user name and password before they get sent using encodeURIComponent.

More generally though, have you tested this method in IE8? Because it doesn't work for normal requests any more - the username:password@ scheme has been disabled there for security reasons.

It could be, though, that they are still allowed in Ajax requests.

answered Jul 21 '10 at 12:03

Pekka

442,112
142
972
1,088

I attempted the encodeURIComponent, and it converted the "&" but not the "@", so it still didn't work. Also, no need to test it in IE8...it si a Palm WebOS app, so it is only going to run there... – Nick DeMayo Jul 21 '10 at 12:13
@sunmorgus strange - it definitely should encode the `@`. But maybe it gets interpreted as part of the URL nevertheless. – Pekka Jul 21 '10 at 12:16

Using Authentication with Ajax.Request

2 Answers2

Linked