Using Authentication with Ajax.Request

Question

I currently have a Palm WebOS application that uses an Ajax.Request to connect to a web service using basic authentication. To send the username and password, I simply include it in the url (i.e. http://username:password@ip-address:port/) which works exceedingly well, expect for when the password contains anything other than alphanumeric characters (for example, I had a user email me lately who included an "@" and an "&" in his password, and he wasn't able to connect because the symbols weren't getting parsed properly for the url). Is there any way around sending the credentials in the url so that I can allow users to use something other than just alphanumeric in their passwords?

    var username = cookie.get().servers[this.serverIndex].username;
    var password = cookie.get().servers[this.serverIndex].password;
    this.auth = 'Basic ' + Base64.encode(username + ':' + password);
    var baseUrl = 'http://' + url + ':' + port + '/gui/';
    this.baseUrl = baseUrl;


    var request = new Ajax.Request(this.tokenUrl, {
        method: 'get',
        timeout: 2000,
        headers: {
            Authorization: this.auth
        },
        onSuccess: successFunc,
        onFailure: this.failure.bind(this)
    });

Response is (I removed the url for security reasons):

{"request": {"options": {"method": "get", "asynchronous": true, "contentType": "application/x-www-form-urlencoded", "encoding": "UTF-8", "parameters": {}, "evalJSON": true, "evalJS": true, "timeout": 2000, "headers": {"Authorization": "Basic c3VubW9yZ3VzOmZyb2dneUAlMjY="}}, "transport": {"readyState": 4, "onloadstart": null, "withCredentials": false, "onerror": null, "onabort": null, "status": 401, "responseXML": null, "onload": null, "onprogress": null, "upload": {"onloadstart": null, "onabort": null, "onerror": null, "onload": null, "onprogress": null}, "statusText": "", "responseText": "", "UNSENT": 0, "OPENED": 1, "HEADERS_RECEIVED": 2, "LOADING": 3, "DONE": 4}, "url": ""

Answer 1

You could try to encode the user name and password before they get sent using encodeURIComponent.

More generally though, have you tested this method in IE8? Because it doesn't work for normal requests any more - the username:password@ scheme has been disabled there for security reasons.

It could be, though, that they are still allowed in Ajax requests.

Answer 2

Send the Basic authentication info with header: http://coderseye.com/2007/how-to-do-http-basic-auth-in-ajax.html

var auth = 'Basic ' + Base64.encode(user + ':' + pass);
Ext.Ajax.request({
    url : url,
    method : 'GET',
    headers : { Authorization : auth }
});