Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>I was facing this problem and this was the only mention of it on the net. In Digest Access Authentication the sequence of events that take place is.</p> <ol> <li>GET on /url</li> <li>401 with a WWW-Authenticate header This pops up the login dialog on your browser. After you enter your credentials.</li> <li>GET on /url along with the Authorization header.</li> <li>200 OK (If everything goes well).</li> </ol> <p>This works fine for Firefox and Chrome but was not working fully for IE8.</p> <p>By fully I mean, that if I did a GET on a virtual location on the server it worked, but it did not work when I did a GET on a static file. In the case for a static file I was prompted for a login again and again. </p> <p>After using a sniffer I found out that in the case of requesting a virtual location the sequence of events happened as mentioned above, but when I requested a static file the sequence was as follows:</p> <ol> <li>GET on /url</li> <li>401 with a WWW-Authenticate header This pops up the login dialog on your browser. After you enter your credentials.</li> <li>GET on /url (WITHOUT THE Authorization header)</li> <li>401 Un-Authorized.</li> </ol> <p>Basically when it was a static file, it took the username and password but never sent it across in the Authorization header. Server not getting this header responded with 401 which again prompted the login.</p> <p>To make IE8 work properly you have to fool it in thinking that this is not a static file, but is a virtual location. For me, it was easy as I had access the server's source code. I really don't know how to do it, if you don't have access to it.</p> <p>If you have requested a virtual location. 1. GET /virtual_location 2. 401 with WWW-Authenticate header which will look something like</p> <p>WWW-Authenticate: Digest realm="validusers@robapi.abb", domain="127.0.0.1:80", qop="auth", nonce="9001cd8a528157344c6373810637d030", opaque="", algorithm="MD5", stale="FALSE"</p> <p>Notice the opapue parameter is an empty string.</p> <p>On the other hand if you requested a static-file 1. GET /staticfile.txt 2. 401 with WWW-Authenticate header which will look something like</p> <p>WWW-Authenticate: Digest realm="validusers@robapi.abb", domain="127.0.0.1:80", qop="auth", nonce="81bd1ca10ed6314570b7362484f0fd31", opaque="0-1c5-4f7f4c1e", algorithm="MD5", stale="FALSE"</p> <p>Here the opaque parameter is a non empty string.</p> <p>Hence, if you an ensure that the opaque parameter is always an empty string, IE8 will consider it as a virtual location and the request will go through normally. Since I had access to the the server's code I was able to do this.</p> <p>Hope this is of any help.</p> <p>Regards, Satya Sidhu</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload