[HTTP Basic Auth] Is there a way to force the browser to always pass the Authorization header if credential is already available?

Question

Using Basic Authentication, if the user has already logged in, the browser will include the username/password in the http request in the succeeding http requests ONLY IF it receives a 401 response containing an authentication challenge. Username/password is passed via Authorization header.

Is there a way to force the browser to always include the Authorization header once the user has logged in?

The reason I'm asking for this is that I have a CGI application (separate from the main CGI app that serves my dynamic pages) that should use the Authorization info if present but should not prompt for it if it's not present.

Thanks.

Answer 1

if the user has already logged in, the browser will include the username/password in the http request in the succeeding http requests ONLY IF it receives a 401 response containing an authentication challenge

This is not the behaviour I see in web browsers; once the browser has received a 401, it always includes the authorization after that. Can you perhaps provide more detail on how to reproduce the problem?

Answer 2

One solution would be to expose one handler of your CGI app, that would generate an HTML page that would do an AJAX call, prompting the 401 that would then be responded to by the browser. Would that make sense?