MSXML2.XMLHTTP username and password encoding

[rlr1031]

I'm working on a project where we have to call up a URL from a Java
servlet - the only sample call we have is some Javascript that used an
MSXML2.XMLHTTP object to send the request, using a username and
password.

How is the username and password actually passed to the target web
server for the request (via MSXML2.XMLHTTP)? That is, are they sent
as HTTP header fields? Are they sent as query parameters? Are they
sent as part of the URL? Are they encoded or encrypted?

I'e already spent a fair amount of time trying to find this out in the
doc and on the 'net, but I'm not finding this level of detail.

Thanks for any insight.

Regards,
Rick

[Kevin Yu [MSFT]]

Hi Rick,

The MSXML2.XMLHTTP is the same as Http. The username and password are in
the HTTP header fields. Whether the username and password are encrypted
depends on the server. If it uses BASIC authentication, they're not
encrypted.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."

[Rick R.]

Hi Kevin-
Thanks for the reply - do you know the names of the HTTP
header fields?

Thanks again,
Regards,
Rick

-----Original Message-----
Hi Rick,

The MSXML2.XMLHTTP is the same as Http. The username and password are inthe HTTP header fields. Whether the username and password are encrypteddepends on the server. If it uses BASIC authentication, they're notencrypted.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers norights."

.

[Martin Honnen]

rlr1031 wrote:

I'm working on a project where we have to call up a URL from a Java
servlet - the only sample call we have is some Javascript that used an
MSXML2.XMLHTTP object to send the request, using a username and
password.

How is the username and password actually passed to the target web
server for the request (via MSXML2.XMLHTTP)? That is, are they sent
as HTTP header fields? Are they sent as query parameters? Are they
sent as part of the URL? Are they encoded or encrypted?

I'e already spent a fair amount of time trying to find this out in the
doc and on the 'net, but I'm not finding this level of detail.

Look at
ftp://ftp.isi.edu/in-notes/rfc2617.txt
it describes HTTP authentication, basically when a page is requested and
authentication is required the server sends a
401 Unauthrorized
WWW-Autenticate: scheme params
and the client is supposed to answer with
Authorization: scheme credentials
where it depends on the scheme whether password are encrypted.
--

Martin Honnen
http://JavaScript.FAQTs.com/

[Kevin Yu [MSFT]]

Hi Rick,

Please try to check the following link for reference:

http://msdn.microsoft.com/library/de...us/act/htm/act
ml_ref_href.asp

Happy New Year!

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."