search

nicolasff / webdis

A Redis HTTP interface with JSON output
https://webd.is
BSD 2-Clause "Simplified" License
2.82k stars 305 forks source link

Q: Basic_authentication cannot use with http://user:password@url.com:7379/command #87

Open ukrit-himakoon opened 10 years ago

ukrit-himakoon commented 10 years ago

Hello I tried to configured acl in webis.json as follows: "acl": [ { "disabled": ["*"] },

            {
                    "http_basic_auth":      "user:password",
                    "enabled":              ["SET"]
            }

]

I can use curl -u user:password to execute "SET" command. Unfortunately, ACL does not work when I input URL to chrome browser: http://user:password@url.com/set/key/1 , I always get 403 forbidden.

Any suggestion for this? Please note that I am using the the released version 0.1

Thanks,

ukrit-himakoon commented 10 years ago

Hello any answer for this?

digitalrinaldo commented 10 years ago

I am seeing the same issue. I don't think wedbis is asking the browser to authenticate the user. curl sends the token with the request -- the browser sends the request and webdis simply says 403.

nicolasff commented 10 years ago

Hello,

Using Chrome with the inspector, I can't see any Basic Auth data being sent: Chrome inspector

Am I missing something? How should this be sent?

adamgoose commented 9 years ago

I'm not exactly sure why this isn't working for you, but the solution is this:

var token = btoa(user+':'+pass)
var header = 'Basic: ' + token;

Add the header variable to the XHR request under the Authorization header.

If you're just trying to test your implementation, try using Postman. It will automatically add the header for you if you add a username and password to the request. Otherwise, you'll have to do the base64 encoding yourself.

anapsix commented 9 years ago

Browser expects a 401, which webdis does not sent. It responds immediately with 403. Curl, on the other hand, sends "Authentication: Basic ####" headers right away.. If you want to talk to webdis from JavaScript, just make sure to send the appropriate headers right away.