PROBLEM
Sometimes the access to a web page or resource should be protected. To accomplish the task use a HTTP authentication. The request for such a resource through the XmlHttpRequest interface or Fetch API may hurt user experience since an alert asking for user credentials will appear.
HTTP AUTHENTICATION
HTTP Authentication provides mechanism to protect web pages and resources.
- BasicThe browser sends the username and password as Base64-encoded text, without any encryption. Basic authenticationshould only be used with HTTPS, otherwise the password can be exposed to everyone.If the client request protected resource without providing credentials, the server will reject the request and send back 401HTTP status and WWW-Authenticate header.
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic realm="Restricted area"Then the browser will display popup asking for user credentials used to retry the request with Authorization header.Authorization: Basic bXl1c2VyOm15cHN3ZA==
- DigestThe client sends the hashed variant of the username and password. Encryption instead of encoding makes the digest authentication safer than basic auth.
REQUEST
The solution is quite simple, an
Authorization header sent with the request.<script>
// using jQuery & 'beforeSend' callback
$.ajax({
xhrFields: {
withCredentials: true
},
beforeSend: function (xhr) {
xhr.setRequestHeader('Authorization', 'Basic ' + btoa('myuser:mypswd'));
},
url: "https://www.example.org/protected-data.php"
});
// using jQuery & 'headers' property
$.ajax({
xhrFields: {
withCredentials: true
},
headers: {
'Authorization': 'Basic ' + btoa('myuser:mypswd')
},
url: "https://www.example.org/protected-data.php"
});
// using XMLHttpRequest
var xhr = new XMLHttpRequest();
xhr.open("GET", "https://www.example.org/protected-data.php", true);
xhr.withCredentials = true;
xhr.setRequestHeader("Authorization", 'Basic ' + btoa('myuser:mypswd'));
xhr.onload = function () {
console.log(xhr.responseText);
};
xhr.send();
// using Fetch API
var myHeaders = new Headers();
myHeaders.append("Authorization", 'Basic ' + btoa('myuser:mypswd'));
fetch("https://www.example.org/protected-data.php", {
credentials: "include",
headers: myHeaders
}).then(function (response) {
return response.json();
}).then(function (json) {
console.log(json);
});
</script>
jQuery API provides
username and password parameters as part of the ajax settings object, which intends to do the job instead of sending a header by yourself, unfortunatelly they doesn’t works.RESPONSE
To trigger the basic authentication use your prefered method.
- PHP
<?php
if (!(isset($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW'])
&& $_SERVER['PHP_AUTH_USER'] == 'myuser'
&& $_SERVER['PHP_AUTH_PW'] == 'mypswd')) {
header('WWW-Authenticate: Basic realm="Restricted area"');
header('HTTP/1.1 401 Unauthorized');
exit;
}
?> - Apache
AuthType Basic
AuthName "Restricted area"
AuthUserFile "/var/www/.htpasswd"
Require valid-user - Nginx
auth_basic "Restricted area";
auth_basic_user_file /var/www/.htpasswd;
htpasswd is used to create and update the flat-files used to store usernames and password for basic authentication of HTTP users.htpasswd -c /var/www/.htpasswd myuser
CROSS-DOMAIN REQUESTS WITH CORS
In case, the protected resource or page is accessible through a domain that differs from the origin, a restriction from same origin policy is applied. To circumvent the same-origin policy, use the Cross-origin resource sharing.
# Request Headers
Authorization: Basic bXl1c2VyOm15cHN3ZA==
Host: subdomain.example.org
Origin: https://www.example.org
# Response Headers
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Origin, Authorization
Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Allow-Origin: https://www.example.org
P3P:CP="CAO PSA OUR"
DEMO
To see an example of ajax basic auth check out our demo.