Can Javascript do Basic Auth in IE6?

[Dave]

A microsoft security patch disabled URLs of the format

http://username:password@somesite.com/someresource

There are programmatic ways to get around this but I can't find an
example in Javascript.

I've seen the msdn knowledge base article on the subject

http://support.microsoft.com/kb/834489/

The registry hack is no good for customers. We can't make them edit
their registry.

I think it is possible to access an ActiveX object that will allow the
username and password to be set programatically .

Under IE Javascript is capable of handling ActiveX objects. Is it
possible to access sites with Basic Auth by allowing Javascript to set
the username and password?

Example code would be great.

Thanks for any help!

[Hywel Jenkins]

Re: Can Javascript do Basic Auth in IE6?

In article <MPG.1d1906c22b dd51009896a6@ne ws.newsguy.com> ,
noemail@anyaddr essiown_invalid .com says...[color=blue]
> A microsoft security patch disabled URLs of the format
>
> http://username:password@somesite.com/someresource
>
> There are programmatic ways to get around this but I can't find an
> example in Javascript.
>
> I've seen the msdn knowledge base article on the subject
>
> http://support.microsoft.com/kb/834489/
>
> The registry hack is no good for customers. We can't make them edit
> their registry.
>
> I think it is possible to access an ActiveX object that will allow the
> username and password to be set programatically .
>
> Under IE Javascript is capable of handling ActiveX objects. Is it
> possible to access sites with Basic Auth by allowing Javascript to set
> the username and password?[/color]

Possibly, but what security is there in sending usernames and passwords
to the client, in clear text?

--
Hywel

Kill the Crazy Frog

http://www.petitiononline.com/crzyfrg/

[Dave]

Can Javascript do Basic Auth in IE6?

Not bullet proof but that is the way some resources protect themselves.

It's still an improvement because the username and password don't appear
in the source of the webpage.

So now, if you want to steal the usename and password you need a proxy
or packet sniffer, not just a browser with a "View Source" option.

In anycase, do you have any information on how it's done?


In article <MPG.1d19d9da6c 06b46f989706@ne ws.eclipse.net. uk>,
hywel.jenkins@g mail.com says...[color=blue]
> In article <MPG.1d1906c22b dd51009896a6@ne ws.newsguy.com> ,
> noemail@anyaddr essiown_invalid .com says...[color=green]
> > A microsoft security patch disabled URLs of the format
> >
> > http://username:password@somesite.com/someresource
> >
> > There are programmatic ways to get around this but I can't find an
> > example in Javascript.
> >
> > I've seen the msdn knowledge base article on the subject
> >
> > http://support.microsoft.com/kb/834489/
> >
> > The registry hack is no good for customers. We can't make them edit
> > their registry.
> >
> > I think it is possible to access an ActiveX object that will allow the
> > username and password to be set programatically .
> >
> > Under IE Javascript is capable of handling ActiveX objects. Is it
> > possible to access sites with Basic Auth by allowing Javascript to set
> > the username and password?[/color]
>
> Possibly, but what security is there in sending usernames and passwords
> to the client, in clear text?
>
>[/color]

[Nathan]

Re: Can Javascript do Basic Auth in IE6?

Do it on the server.

Best way to lock it down is by having either a server-side script to do
authorization, or use a .htaccess file (Apache) to prompt.

[Dave]

Re: Can Javascript do Basic Auth in IE6?

In article <1118855630.406 841.67870@z14g2 000cwz.googlegr oups.com>,
nathan.degruchy @gmail.com says...[color=blue]
> Do it on the server.
>
> Best way to lock it down is by having either a server-side script to do
> authorization, or use a .htaccess file (Apache) to prompt.
>
>[/color]
Our servers may not have access to the protected resource due to our
customers network topology, firewalls or whatever.

We ned to produce a page that will give our customers direct accccess to
Basic Auth resources. We can't always do it on the server.

In anycase, I finally figured out the code and I'll post the answer
later.

[Dave]

Can Javascript do Basic Auth in IE6?

Yes it can, in at least one way:

function getDoc(url,user name,password){
var WinHttpReq = new ActiveXObject(" WinHttp.WinHttp Request.5.1");

WinHttpReq.Open ("GET", url, false);
WinHttpReq.SetC redentials(user name,password,0 );
WinHttpReq.Send ();
if (WinHttpReq.Sta tus==200){
document.write( WinHttpReq.Resp onseText);
}

The above javascript method seems to successfully get a password
protected resource in IE6 that used to be accessible through a URL of
the format

http://username:password@somesite.com/someresource

before.

any obvious problems with the code?



In article <MPG.1d1906c22b dd51009896a6@ne ws.newsguy.com> ,
noemail@anyaddr essiown_invalid .com says...[color=blue]
> A microsoft security patch disabled URLs of the format
>
> http://username:password@somesite.com/someresource
>
> There are programmatic ways to get around this but I can't find an
> example in Javascript.
>
> I've seen the msdn knowledge base article on the subject
>
> http://support.microsoft.com/kb/834489/
>
> The registry hack is no good for customers. We can't make them edit
> their registry.
>
> I think it is possible to access an ActiveX object that will allow the
> username and password to be set programatically .
>
> Under IE Javascript is capable of handling ActiveX objects. Is it
> possible to access sites with Basic Auth by allowing Javascript to set
> the username and password?
>
> Example code would be great.
>
> Thanks for any help!
>[/color]

[Grant Wagner]

Re: Can Javascript do Basic Auth in IE6?

"Dave" <noemail@anyadd ressiown_invali d.com> wrote in message
news:MPG.1d1b9e dd7092875e9896a 9@news.newsguy. com...[color=blue]
> Yes it can, in at least one way:
>
> function getDoc(url,user name,password){
> var WinHttpReq = new ActiveXObject(" WinHttp.WinHttp Request.5.1");
>
> WinHttpReq.Open ("GET", url, false);
> WinHttpReq.SetC redentials(user name,password,0 );
> WinHttpReq.Send ();
> if (WinHttpReq.Sta tus==200){
> document.write( WinHttpReq.Resp onseText);
> }
>
> The above javascript method seems to successfully get a password
> protected resource in IE6 that used to be accessible through a URL of
> the format
>
> http://username:password@somesite.com/someresource
>
> before.
>
> any obvious problems with the code?[/color]

Any obvious problems with the code other than the fact that if you
include the code on a page on your Internet site and attempt to browse
the site with Internet Explorer in the default configuration you get an
"Automation server can't create object" error?

--
Grant Wagner <gwagner@agrico reunited.com>
comp.lang.javas cript FAQ - http://jibbering.com/faq

[Thomas 'PointedEars' Lahn]

Re: Can Javascript do Basic Auth in IE6?

Grant Wagner wrote:
[color=blue]
> "Dave" <noemail@anyadd ressiown_invali d.com> wrote [...]:[color=green]
>> Yes it can, in at least one way:
>>
>> function getDoc(url,user name,password){
>> var WinHttpReq = new ActiveXObject(" WinHttp.WinHttp Request.5.1");[/color][/color]
^^^^^^^^^^^^^^^ ^^^^^^^^^^^[color=blue][color=green]
>> [...]
>>
>> The above javascript method seems to successfully get a password
>> protected resource in IE6 that used to be accessible through a URL of
>> the format
>>
>> http://username:password@somesite.com/someresource
>>
>> before.
>>
>> any obvious problems with the code?[/color]
>
> Any obvious problems with the code other than the fact that if you
> include the code on a page on your Internet site and attempt to browse
> the site with Internet Explorer in the default configuration you get an
> "Automation server can't create object" error?[/color]

Yes, and HTTP URIs do not support the FTP URI scheme feature of passing
user names and passwords in the URL (at least they should not and if they
do in a UA that has to be considered a bug, there is nothing in HTTP/1.0
or HTTP/1.1 that supports such); HTTP Authentication serves that purpose
instead.


PointedEars