Cookieless Authentication – Client side
In my previous posts I have given an update about the REST based authentication I am still working on; basically I am trying to have a two level of logout mechanism: one at the server side and the other at the client side. The server side to assure the authentication mechanism and the client side to share a common front-end logout to different back-end programming choices.
To start, I have to say that if you think that you will find a logout mechanism that works perfectly great for any browser platform in this article, then I recommend you to stop here and keep searching. From my experience, it can get really annoying at certain point; but it really helps you to understand what you are doing.
Just to review some of the aspects that I considering for my login/logout mechanism:
- 2 levels: client side and server side.
- no cookies, so every should be handled by the Authorization field in the header.
- Preference for Digest Access Authentication Scheme, is not suitable then Basic Authentication Scheme
With that said, then let’s see how we can deal with these requirements. In this post I am dealing with the client side, with no cookies and using Digest Authentication. So far this is still my latest code for doing the logout:
<script language="javascript" type="text/javascript">
try{
var agt=navigator.userAgent.toLowerCase();
if (agt.indexOf("msie") != -1) {
// IE clear HTTP Authentication
document.execCommand("ClearAuthenticationCache");
}
else {
var xmlhttp = createXMLObject();
xmlhttp.open("GET","PAGE FROM REALM TO LOGOUT",true,"logout","logout");
xmlhttp.send("");
xmlhttp.abort();
}
} catch(e) {
// There was an error
alert("there was an error");
}
function createXMLObject() {
try {
if (window.XMLHttpRequest) {
xmlhttp = new XMLHttpRequest();
}
// code for IE
else if (window.ActiveXObject) {
xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
}
} catch (e) {
xmlhttp=false
}
return xmlhttp;
}
</script>
So, the main issue here is a cross-browser solution, thus as you might know, it is not so easy to implement. Now, let’s talk about each one separately:
Internet Explorer: so far this is the eassiest browser to work with, they provide a one-line-code of Javascript to perform the logout:
document.execCommand(“ClearAuthenticationCache”);
and since IE still has a great amount of users out there then this is good news. It works well for IE6 and IE7. I have not tested it with lower versions neither on a Mac.
Firefox: the good thing about this browser is that there are good tools for developers to debug your code, so you can work better. In my case, I use the Live HTTP Headers extension to see in real-time all the HTTP requests and responses that my browser sends and receives, as well as the FireBug to debug the browser behaivor. In my solution I make use of the XMLHttpRequest Object. So, recently I tracked my logout mechanism for Firefox with the HTTP tool to better understand it and I got the following conclusions from the code above:
- var xmlhttp = createXMLObject();: Here I create the object
- xmlhttp.open(“GET”,”PAGE FROM REALM TO LOGOUT”,true,”logout”,”logout”);: The value of “true” in the async parameter is REQUIRED. Having true means that my script will continue executing after the send() method, without waiting for a response; as opposed to “false” that means that the script waits for a response before continuing processing [1]. I want this because I want the script to abort before being sent. The username is REQUIRED too. This username will replace the username name that was part of the Authorization, thus, making the trick to obtain a login popup window next time we want to login. The first argument could be any method: GET (tested), POST (tested), HEAD (not tested), PUT (not tested), DELETE (not tested), etc. The second argument should be a page located in the realm for authentication; I haven’t tried to put any other page, but I think it should be fine too.
- xmlhttp.send(“”);: Here the server will try to send the request, so it creates the new headers and gets ready to send an empty value.
- xmlhttp.abort();: This is the one that will stop the above command to be executed, but since the headers have been already replaced with a wrong username, the next time you try to connect it will ask you for right credentials. Notice that this is also the one line that prevents Firefox to display the authentication popup to appear.
Opera: I have tried to run the same of this browser (version 9 and up) but it doesn’t work. I believe because of this “XMLHTTPRequest is a work in progress, we expect to fully support it when it becomes a recommendation” (link).
Safari: I don’t have a Mac, so the only times I can test this is at university and a couple of friends. No much time to test it extensively, but it doesn’t work, I believe because the same reason of Safari, lack of full implementation of the XMLHttpRequest.
Well, that is it by now for the client side part. Next I will try to explain my solution for the server side.
References:
1.- The The HttpRequest Object from w3schools. link
Thank you for reading this post. You can now Read Comments (5) or Leave A Trackback.
Post Info
This entry was posted on Tuesday, April 3rd, 2007 and is filed under Javascript.You can follow any responses to this entry through the Comments Feed. You can Leave A Comment, or A Trackback.
Previous Post: Cookieless authentication (part 2) »
Next Post: DICOM php »
- How to connect to Mysql using SSH in Windows
- Announcing a new PHP DICOM toolkit: Nanodicom
- Nuevo Portal LoteriaFutbol.com: La Polla del Mundial Sudáfrica 2010.
- Kohana 3: AUTH, A2 & ACL
- Kohana[v2.3]: AUTH, A2 & ACL
- Real NAT on Windows XP
- New home for this package
- File_DICOM.php update
- The unofficial File_DICOM.php v 0.3
- DICOM php
April 25th, 2007 18:09
hola quisiera saber de que pais eres
June 4th, 2009 18:32
I can’t seem to get your RSS feed to work with my program. Do you mind telling me the url so I can read your posts on my own program?
December 16th, 2009 12:23
[…] ran into this exact problem today while developing a web app. There are several “workarounds” but none very easy to implement. In my case, I just needed to capture the Kerberos username […]
May 19th, 2010 08:00
Hi.
I was wondering if there has been any news on getting this to work with Chrome or Opera.
Thanks
Neil
May 23rd, 2012 03:37
[…] can be done, but is tricky. There is no default way to do this. Conclusion drawn from various […]