Get Authorization from HTTP-Request header

Question

I already searched within SO for some threads about this, but could only find some which explained what this header is for or how to get the authorization header in c# but I don't want to read it from server side but from client side.

Is there any way to get the Base64 encoded header "Authorization" from the browser? I want to implement a tool where you can log in and if you click on a spezific button your username will be saved.

My problem is that the browser does the authorization automatically, and with jQuery and JavaScript methods you can only set the requestheaders and get the responseheaders. I couldn't find a method to get the requestheaders.

The library gethttp could get some headers, but not the authorization header. My guess is that this header is hidden.

I'm doing a login via SVN and the browser does the authorization the moment you enter the website.

Only the username is enough. I'm searching for solutions where the user doesn't have to input their username.

Solution 1

I'm assuming you're trying to use the Basic Realm authorisation mechanism This had already been replied on Stackoverflow and involves the $.ajax() jquery object.
How to use Basic Auth with jQuery and AJAX?
So please don't upvote me on this

$.ajaxSetup({
  headers: {
    'Authorization': "Basic XXXXX"
  },
  data: '{ "comment" }',
  success: function (){
    alert('Thanks for your comment!'); 
  }
});

where XXXXX is your username:password base64 encoded

Solution 2

You can use native fetch API:

fetch("http://localhost:8888/validate",{
  method:"GET",
  headers: {"Authorization": "Bearer xxxxx"}
})
.then(res => res.json())
.then(
  (result) => {
    // do something
  },
  // Note: it's important to handle errors here
  // instead of a catch() block so that we don't swallow
  // exceptions from actual bugs in components.
  (error) => {
    // handle error
  }
)

Comments

[haim770]

You're trying to read that header using C# in the server-side or using Javascript in the client-side?

[php_nub_qq]

You should never trust the browser, it's like the first rule of web club, come on!

[manti]

well it's just for use within intranet so it shouldn't be that big of a problem

[afilina]

Except the headers you get are those you send in the xhr, so they're already known to you. There is no point in doing this.

[mik01aj]

No, it's not possible. You can't get these headers in JS. stackoverflow.com/questions/7564007/…

[Michael]

why do you need to implement this decodeBase64 function when the built-in atob function decodes base64?

[Jens Kooij]

Great point. I used this mainly because I was unaware of this built-in at the time.