AngularJS browser authentication prompt

Question

I'm developping an application in AngularJS for the front-end and JavaEE for the back-end. In my AngularJS application I try to access a REST resource provided by my back-end. this resource is protected with JAAS, so only authenticated users can access the resource.

in my AngularJS app :

$http.get('/webresources/project/').success(function(data){...}).error(function(){...});

The project resource is protected by my web.xml file :

...
<login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>file</realm-name>
</login-config>

<security-constraint>
    <web-resource-collection>
        <web-resource-name>Protected Area</web-resource-name>
        <url-pattern>/webresources/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>user</role-name>
    </auth-constraint>
</security-constraint>
...

The thing is that when I try to access this resource when not authenticated the browser display the login prompt and my request is in pending state until I click Cancel then the response is 401 with WWW-Authenticate header.

What I want is that I can get rid of this browser login prompt and display my own login form. So I found some solutions but I don't know how to implement them:

1- Say To the back-end not to send WWW-Authenticate header. How to do this in Java ?
2- Send another status code instead of 401. Is it a correct behavior. ? if yes : how to do that ?

Thanks for your help.

Ok Guys, I found something strange. I tried adding the "Authorization" header initialized with the value "Basic " in the request headers : $http.defaults.headers.common['Authorization'] = 'Basic '; and it is working in Firefox (no browser login prompt) but in chrome the browser login prompt still appear. — Hurricane13
– Hurricane13, Commented Jul 30, 2013 at 14:05
Have you found a solution to your problem? I have a similar problem and cannot fix it. — zip
– zip, Commented Aug 18, 2013 at 16:15

Stephan · Accepted Answer · 2013-09-06 22:40:38Z

1

You can do a simple trick:

Create a 401.jsp error page and add it to your web.xml; In it do:

<%
response.reset();
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
%>

This will remove the WWW-Authenticate header because of the reset, but still serve a 401 status.

Hope it helps

answered Sep 6, 2013 at 22:40

Stephan

113 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

AngularJS browser authentication prompt

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related