Using Authentication with Ajax.Request

Question

I currently have a Palm WebOS application that uses an Ajax.Request to connect to a web service using basic authentication. To send the username and password, I simply include it in the url (i.e. http://username:password@ip-address:port/) which works exceedingly well, expect for when the password contains anything other than alphanumeric characters (for example, I had a user email me lately who included an "@" and an "&" in his password, and he wasn't able to connect because the symbols weren't getting parsed properly for the url). Is there any way around sending the credentials in the url so that I can allow users to use something other than just alphanumeric in their passwords?

    var username = cookie.get().servers[this.serverIndex].username;
    var password = cookie.get().servers[this.serverIndex].password;
    this.auth = 'Basic ' + Base64.encode(username + ':' + password);
    var baseUrl = 'http://' + url + ':' + port + '/gui/';
    this.baseUrl = baseUrl;


    var request = new Ajax.Request(this.tokenUrl, {
        method: 'get',
        timeout: 2000,
        headers: {
            Authorization: this.auth
        },
        onSuccess: successFunc,
        onFailure: this.failure.bind(this)
    });

Response is (I removed the url for security reasons):

{"request": {"options": {"method": "get", "asynchronous": true, "contentType": "application/x-www-form-urlencoded", "encoding": "UTF-8", "parameters": {}, "evalJSON": true, "evalJS": true, "timeout": 2000, "headers": {"Authorization": "Basic c3VubW9yZ3VzOmZyb2dneUAlMjY="}}, "transport": {"readyState": 4, "onloadstart": null, "withCredentials": false, "onerror": null, "onabort": null, "status": 401, "responseXML": null, "onload": null, "onprogress": null, "upload": {"onloadstart": null, "onabort": null, "onerror": null, "onload": null, "onprogress": null}, "statusText": "", "responseText": "", "UNSENT": 0, "OPENED": 1, "HEADERS_RECEIVED": 2, "LOADING": 3, "DONE": 4}, "url": ""

Introversion

Answer 1

Send the Basic authentication info with header: http://coderseye.com/2007/how-to-do-http-basic-auth-in-ajax.html

var auth = 'Basic ' + Base64.encode(user + ':' + pass);
Ext.Ajax.request({
    url : url,
    method : 'GET',
    headers : { Authorization : auth }
});

Haggadah

Ok, tried that, and I am getting a 401 error...edited my post with my Ajax.Request call and my response... – Introversion

Ok, I got it working! I had to change 'headers' to 'requestHeaders', and everything is working great! Thanks! – Introversion

Answer 2

You could try to encode the user name and password before they get sent using encodeURIComponent.

More generally though, have you tested this method in IE8? Because it doesn't work for normal requests any more - the username:password@ scheme has been disabled there for security reasons.

It could be, though, that they are still allowed in Ajax requests.

Colleen

I attempted the encodeURIComponent, and it converted the "&" but not the "@", so it still didn't work. Also, no need to test it in IE8...it si a Palm WebOS app, so it is only going to run there... – Introversion

@sunmorgus strange - it definitely should encode the @. But maybe it gets interpreted as part of the URL nevertheless. – Colleen