Avoid HTTP auth popup in a chrome extension (digest)

问题

I'm currently developing a chrome extension, I need to access some http-auth protected resources (webdav). The HTTP auth is using (in the best case) a digest authentication.

I'm able to do the auth directly in the ajax request using the https://login:password@domain.tld/path/to/ressource form.

The issue is : if the login/password is wrong, I can't just get a 401 status (unauthorized), Chrome pops up the regular authentication dialog. Which I don't want cause it's confusing for user and I can't save the credentials from here.

EDIT: Another use-case I faced is : I want to check if a resource is password-protected without trying to provide credentials to actualy access it.

Any ideas on how to catch the 401 without poping the Chrome's auth box ?

回答1:

Google Chrome teams has implented the onAuthRequired event in Google Chrome 22, so now is possible detect when the HTTP Basic Authentication is required.

In fact I wrote a extension that automatically sends the HTTP Basic Authentication credentials using the onAuthRequired event.

It is available for free in the official Google Chrome web store: https://chrome.google.com/webstore/detail/basic-authentication-auto/dgpgkkfheijbcgjklcbnokoleebmeokn

Usage example of onAuthRequired event:

sendCredentials = function(status)
{   
    console.log(status);
    return {username: "foo", password: "bar"};
}

chrome.webRequest.onAuthRequired.addListener(sendCredentials, {urls: ["<all_urls>"]}, ["blocking"]);

You need to add the right permissions to the manifest file in order to use the onAuthRequired.

"permissions": [ "http://*/*", "https://*/*", "webRequest", "webRequestBlocking", "tabs" ],

Download the extensions and check the source code for a better approach.

It should work even if the request was initiated from another extension.

回答2:

It's really seems to be a lack in chrome behavior, other people are wishing to see something as the mozBakgroundRequest Chris highlighted, there already a a bug report for that.

There are (hackish) workarounds suggested by some developers in the bugtracker :

use a webworker and a timeout to perform the request
do the same with the background page

In both case, the benefit is that it won't pop an authentication box... But you will never know if it's a real server timeout or a 401. (I didn't tested those workarounds).