Open cklanac opened 6 years ago
Beyond fixing the issue with the above solution, we can consider changing to another form of authentication.
I considered Digest initially, but quickly found that it would be difficult to implement in our projects. The key issue is that digest hashes the password in the browser (hence the name) and if we override it with JS for SPAs and HTML forms then we need to hash the password in JS. So if we decide to switch, I suggest we change to Local. Below is a list of pros/cons
www-authenticate
header bodyparser.urlencoded()
to curriculum and sample reposYep, I'm definitely for switching to Local Auth here. Fixes the issues with jQuery AJAX, and is just a simple (actually even a little simpler) than Basic Auth. The non-standardized thing is annoying, but I'm not going to lose any sleep over it.
@oampo @benjaminEwhite,
The dialog box used by basic authentication pops up when incorrect UN/PW submission.
The issue can be fixed by adding
failWithError: true
to the middleware as followsThis allows us to remove the
www-authenticate
header before sending the response which suppresses the built-in dialog.