[whatwg] Form-based HTTP Authentication Proof of Concept

Timothy D. Morgan tmorgan at vsecurity.com
Thu Feb 25 08:00:37 PST 2010


As a follow up to my paper advocating HTTP authentication over 
cookies [1], I've built a simple sample application which demonstrates
how a combination of XMLHttpRequest and response code tricks can be 
used to achieve form-based login, logout, and authenticated password
changes in the four most popular browsers:                   

Note that this is achieved without using any checks to determine what 
browser is being used.

While this is promising, I still think we should have an HTTP-based 
log out mechanism.  In addition, the proposed W3C change to 
XMLHttpRequest authentication behavior will make this code much 


1. http://www.vsecurity.com/download/papers/WeaningTheWebOffOfSessionCookies.pdf

More information about the whatwg mailing list