3 ms·

Nothing prevents serving this style of login from a front page that offers everything you just mentioned as an alternative. Groaning may express dismay but --

Nothing prevents serving this style of login from a front page that offers everything you just mentioned as an alternative. Groaning may express dismay but -- this is mere inconvenience we're dealing with here.

lil_dispaches 5y ago
How do you get the browser to send the Authentication header for every request thereafter? Typically you Auth once, and set cookies which the browser sends automatically with each HTTP request, even if the user is not on your domain. You would have to rewrite HTML5 and handle all HTTP traffic manually to set the Authentication header for every request. OP's trick of HTTP + ancient browser spec for handling basic auth triggers automatic sending of the Auth header for all requests.
- jeroenhd 5y ago
  As the article states: > the nice thing about this is that the browser will keep sending the credentials to subsequent requests of the same domain until it receives a 401 status as response. You don't need to set anything, just send a 401 if you want the browser to stop sending credentials. You don't even need cookies.
toast0 5y ago
You can serve this style of login from a front page, but then the user gets the unstyled, limited context browser prompt before they see your site. There's no button to create a new account or find a forgotten password. There's no reasonable way to logout. It's usable for a site with a trainable user base, like a small club or employees, but I wouldn't expect anything intended for public use to do it. I've experienced one public site that used it for its members only (subscription) content, but I think they've switched to forms and cookies.
- jeroenhd 5y ago
  From the article: > the nice thing about this is that the browser will keep sending the credentials to subsequent requests of the same domain until it receives a 401 status as response. The logout button can simply redirect to a static page that returns a 401.

lil_dispaches 5y ago

How do you get the browser to send the Authentication header for every request thereafter? Typically you Auth once, and set cookies which the browser sends automatically with each HTTP request, even if the user is not on your domain. You would have to rewrite HTML5 and handle all HTTP traffic manually to set the Authentication header for every request. OP's trick of HTTP + ancient browser spec for handling basic auth triggers automatic sending of the Auth header for all requests.

jeroenhd 5y ago
As the article states: > the nice thing about this is that the browser will keep sending the credentials to subsequent requests of the same domain until it receives a 401 status as response. You don't need to set anything, just send a 401 if you want the browser to stop sending credentials. You don't even need cookies.

toast0 5y ago

You can serve this style of login from a front page, but then the user gets the unstyled, limited context browser prompt before they see your site. There's no button to create a new account or find a forgotten password. There's no reasonable way to logout. It's usable for a site with a trainable user base, like a small club or employees, but I wouldn't expect anything intended for public use to do it. I've experienced one public site that used it for its members only (subscription) content, but I think they've switched to forms and cookies.

jeroenhd 5y ago
From the article: > the nice thing about this is that the browser will keep sending the credentials to subsequent requests of the same domain until it receives a 401 status as response. The logout button can simply redirect to a static page that returns a 401.