XHR: sending a request with NTLM-authentication always ends with 401 error

Forums » Dev.Opera » General Web Development Discussions

You need to be logged in to post in the forums. If you do not have an account, please sign up first.

12. October 2012, 09:01:40

Posts: 5

XHR: sending a request with NTLM-authentication always ends with 401 error

Given a jQuery.ajax call to some resource (e.g. "http://localhost/myapp/api/products").
Access to this url is guarded by NTLM authentication (IIS7).
When client code sends a request (xhr.open) Opera shows the authenticatoin dialog (for login/password). I enter correct credentials and press ok.
After that I can see that the server and the browser exchange two requests/responses. This is usual two-phase negotiation. All browsers behave in the same way.
But.
All other browsers (IE, Chrome, FF) hide the first server's response with 401 and return control to xhr (call callback and so on) only after the second response with 200 code is got.
Opera reacts on the first 401 server's response. So client code which calls xhr.open mistakenly gets an error.

It's a showstopper bug. I just can't run app with ntlm auth in Opera.
Is there any workaround?

Here's negotiation sessions:

POST /ajax/auth/login HTTP/1.1
User-Agent: Opera/9.80 (Windows NT 6.1; WOW64; U; en) Presto/2.10.289 Version/12.02
Host: 127.0.0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Encoding: gzip, deflate
Authorization: Negotiate TlRMTVNTUAABAAAAl4II4gAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==
Referer: http://ipv4.fiddler/ajax/
Connection: Keep-Alive
Content-Length: 0
Accept: */*
X-Requested-With: XMLHttpRequest

HTTP/1.1 401 Unauthorized
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
WWW-Authenticate: Negotiate TlRMTVNTUAACAAAAGAAYADgAAAAVgori1Z33VoY63H4AAAAAAAAAAIAAgABQAAAABgGxHQAAAA9TAEQATwBSAE8ARwBJAE4ALQBOAEUAVwACABgAUwBEAE8AUgBPAEcASQBOAC0ATgBFAFcAAQAYAFMARABPAFIATwBHAEkATgAtAE4ARQBXAAQAGABTAEQAbwByAG8AZwBpAG4ALQBOAEUAVwADABgAUwBEAG8AcgBvAGcAaQBuAC0ATgBFAFcABwAIAO5t067Wp80BAAAAAA==
Date: Thu, 11 Oct 2012 17:34:36 GMT
Content-Length: 341
Proxy-Support: Session-Based-Authentication

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>Not Authorized</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>
<BODY><h2>Not Authorized</h2>
<hr><p>HTTP Error 401. The requested resource requires user authentication.</p>
</BODY></HTML>

------------------------------------------------------------------
POST /ajax/auth/login HTTP/1.1
User-Agent: Opera/9.80 (Windows NT 6.1; WOW64; U; en) Presto/2.10.289 Version/12.02
Host: 127.0.0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Encoding: gzip, deflate
Authorization: Negotiate TlRMTVNTUAADAAAAGAAYAJQAAAAwATABrAAAABgAGABYAAAADAAMAHAAAAAYABgAfAAAABAAEADcAQAAFYKI4gYBsR0AAAAPtWcPoweYndy6R3dZXTX/7lMARABvAHIAbwBnAGkAbgAtAE4ARQBXAFMAaAByAGkAawBlAFMARABPAFIATwBHAEkATgAtAE4ARQBXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEvqJcnzgMBrM2US5nNWAUEBAQAAAAAAAO5t067Wp80BzoEQtnTic34AAAAAAgAYAFMARABPAFIATwBHAEkATgAtAE4ARQBXAAEAGABTAEQATwBSAE8ARwBJAE4ALQBOAEUAVwAEABgAUwBEAG8AcgBvAGcAaQBuAC0ATgBFAFcAAwAYAFMARABvAHIAbwBnAGkAbgAtAE4ARQBXAAcACADubdOu1qfNAQYABAACAAAACAAwADAAAAAAAAAAAQAAAAAgAADyRVUr/W6U/bOZwXf5KzZvk0YKwaKnO067hkhJXlh9rAoAEAAAAAAAAAAAAAAAAAAAAAAACQAoAHcAdwB3AC8AaQBwAHYANAAuAGYAaQBkAGQAbABlAHIAOgA4ADAALwAAAAAAAAAAAAAAAADB9t3m6VD8K1B/3nQX9Nnz
Referer: http://ipv4.fiddler/ajax/
Connection: Keep-Alive
Content-Length: 0
Accept: */*
X-Requested-With: XMLHttpRequest

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/json; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
x-ver: 0.1-20121011-20173589
X-AspNet-Version: 4.0.30319
Set-Cookie: .ASPXAUTH=2ED35E2FD772C8DD9792A67C6F086FA02CD5F5D76D7D701918A498FE17B50CBF10D9E02AC82AEC84BD1AD49DE4C86DDF87EC5FE8BE0A7EABCC0ED67487029EFE30E979E923B462C25A0353DE467ED247F599E40A6664AED3478531CA93F914A4F95161B72DD4751F854615D752176CEC6B23521743F9B7155B77C00708DDC5EE13F7C96306B44077641D5DDDB033EC5350D78ED006D740242DF7469B4F607B33; expires=Fri, 11-Oct-2013 17:34:36 GMT; path=/; HttpOnly
Persistent-Auth: true
X-UA-Compatible: IE=Edge,chrome=1
Date: Thu, 11 Oct 2012 17:34:36 GMT
Content-Length: 457

{
"result": {
"__metadata": {
"type": "User",
"ts": 94
},
"id": "237f555e-a649-4b5c-9a13-3d16efe44b2a" ... some my data
}
}
------------------------------------------------------------------

15. October 2012, 13:18:13

EvilShrike

Posts: 5

Dear Opera employees, do you have any ideas?

24. October 2012, 12:44:29