Avoid HTTP auth popup in a chrome extension (diges

问题:

I'm currently developing a chrome extension, I need to access some http-auth protected resources (webdav). The HTTP auth is using (in the best case) a digest authentication.

I'm able to do the auth directly in the ajax request using the https://login:[e-mail]/path/to/ressource form.

The issue is : if the login/password is wrong, I can't just get a 401 status (unauthorized), Chrome pops up the regular authentication dialog. Which I don't want cause it's confusing for user and I can't save the credentials from here.

EDIT: Another use-case I faced is : I want to check if a resource is password-protected without trying to provide credentials to actualy access it.

Any ideas on how to catch the 401 without poping the Chrome's auth box ?

回答1:

Google Chrome teams has implented the onAuthRequired event in Google Chrome 22, so now is possible detect when the HTTP Basic Authentication is required.

In fact I wrote a extension that automatically sends the HTTP Basic Authentication credentials using the onAuthRequired event.

It is available for free in the official Google Chrome web store: https://chrome.google.com/webstore/detail/basic-authentication-auto/dgpgkkfheijbcgjklcbnokoleebmeokn

Usage example of onAuthRequired event:

sendCredentials = function(status)
{   
    console.log(status);
    return {username: "foo", password: "bar"};
}

chrome.webRequest.onAuthRequired.addListener(sendCredentials, {urls: ["<all_urls>"]}, ["blocking"]);

You need to add the right permissions to the manifest file in order to use the onAuthRequired.

"permissions": [ "http://*/*", "https://*/*", "webRequest", "webRequestBlocking", "tabs" ],

Download the extensions and check the source code for a better approach.

It should work even if the request was initiated from another extension.

回答2:

It's really seems to be a lack in chrome behavior, other people are wishing to see something as the mozBakgroundRequest Chris highlighted, there already a a bug report for that.

There are (hackish) workarounds suggested by some developers in the bugtracker :

• use a webworker and a timeout to perform the request
• do the same with the background page

In both case, the benefit is that it won't pop an authentication box... But you will never know if it's a real server timeout or a 401. (I didn't tested those workarounds).

回答3:

I think this is impossible. If you are using the browser's http client then it will prompt the user for credentials on a 401.

EDIT : Over in mozilla land https://developer.mozilla.org/en/XMLHttpRequest check out "mozBackgroundRequest".