Created
November 1, 2012 04:43
-
-
Save panzi/3991858 to your computer and use it in GitHub Desktop.
Cross site HTTP Auth via JavaScript
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
_loginBrowser: function () { | |
// HTTP Auth hack for Firefox, Opera and IE. | |
this._loginScript("http://stream.magnatune.com"); | |
}, | |
_loginScript: function (origin, options) { | |
var finished = false; | |
var onerror = function (event) { | |
if (finished) return; | |
if (event.originalEvent.target === script) { | |
finished = true; | |
Magnatune.authenticated = false; | |
Magnatune.Player.setMember(false); | |
$(window).off('error',onerror); | |
$(this).off('readystatechange', onreadystatechange).remove(); | |
if (options && options.error) { | |
options.error.call(this,event); | |
} | |
} | |
}; | |
var onload = function (event) { | |
if (finished) return; | |
finished = true; | |
Magnatune.authenticated = true; | |
try { Magnatune.Player.reload(); } catch (e) { console.error(e); } | |
$(window).off('error',onerror); | |
$(this).off('readystatechange', onreadystatechange).remove(); | |
if (options && options.success) { | |
options.success.call(this,event); | |
} | |
}; | |
var onreadystatechange = function (event) { | |
if (finished) return; | |
if (this.readyState === "loaded" || this.readyState === "complete") { | |
// delay so onerror can fire in IE (which old IE does not do) | |
setTimeout(onload.bind(this,event), 0); | |
} | |
}; | |
$(window).on('error',onerror); | |
var script = tag('script',{ | |
type:'text/javascript', | |
src: origin+"/info/changed.txt?"+(new Date().getTime()), | |
onload: onload, | |
onerror: onerror, | |
onabort: onerror | |
}); | |
if ($.browser.msie) { | |
$(script).on('readystatechange',onreadystatechange); | |
} | |
document.body.appendChild(script); | |
}, |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<!DOCTYPE html> | |
<html> | |
<head> | |
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> | |
<meta http-equiv="X-UA-Compatible" content="IE=edge"/> | |
<title>Magnatune Login</title> | |
<script type="text/javascript"> | |
// <![CDATA[ | |
window.open('','_self',''); | |
window.MagnatuneLoginSuccess = true; | |
window.close(); | |
// ]]> | |
</script> | |
</head> | |
<body> | |
<center>Login Successful!</center> | |
</body> | |
</html> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
_loginPopup: function () { | |
// HTTP Auth hack for Chrome >= 19 | |
var width = 348; | |
var height = 170; | |
var top = $.window.screenY() + Math.round(($.window.outerHeight() - height) * 0.5); | |
var left = $.window.screenX() + Math.round(($.window.outerWidth() - width) * 0.5); | |
// Note that I append a time stamp to the URL to be sure that the browser does not do any caching. | |
var url = "http://stream.magnatune.com/redir?url="+encodeURIComponent(absurl("login.html"))+"&"+(new Date().getTime()); | |
var target = "MagnatuneLogin"; | |
var options = "top="+top+",left="+left+",width="+width+",height="+height+ | |
",resizeable=false,location=false,menubar=false,status=false"+ | |
",dependant=true,scrollbars=false"; | |
var child = window.open(url, target, options); | |
var ended = false; | |
var loginTimer = null; | |
try { | |
child.document.title = "Magnatune Login"; | |
} | |
catch (e) { | |
console.error(e); | |
} | |
function endLogin () { | |
ended = true; | |
try { $(child).off("load", loadLogin); } catch (e) {} | |
if (loginTimer !== null) { | |
clearInterval(loginTimer); | |
loginTimer = null; | |
} | |
if (!child.closed) { | |
try { child.close(); } catch (e) {} | |
} | |
} | |
function loadLogin (event) { | |
if (ended) { return; } | |
var href, access; | |
try { | |
href = child.location ? child.location.href : null; | |
access = true; | |
} catch (e) { | |
access = false; | |
} | |
if (!access) { | |
// on other domain -> user clicked cancel | |
// Chrome seem not to throw an exception on an illegal access | |
// but instead return null/undefined. But it does not hurt to | |
// handle this case anyway. | |
endLogin(); | |
Magnatune.authenticated = false; | |
Magnatune.Player.setMember(false); | |
} | |
else if (child.closed || href !== "about:blank") { | |
endLogin(); | |
if (child.MagnatuneLoginSuccess) { | |
Magnatune.authenticated = true; | |
try { Magnatune.Player.reload(); } catch (e) { console.error(e); } | |
} | |
else { | |
Magnatune.authenticated = false; | |
Magnatune.Player.setMember(false); | |
} | |
} | |
} | |
loginTimer = setInterval(loadLogin, 1000); | |
$(child).on('load', loadLogin); | |
$(child).on('unload', setTimeout.bind(window, loadLogin, 20)); | |
}, |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
_loginUrl: function () { | |
// HTTP Auth hack for Chrome (< 19)/WebKit | |
var username = $('#username').val(); | |
var password = $('#password').val(); | |
if (!username || !password) { | |
alert("Please enter your username and password."); | |
return; | |
} | |
var spinner = $('#login-spinner'); | |
var spin = function () { | |
spinner.show().rotate({ | |
angle: 0, | |
animateTo: 360, | |
easing: function (x,t,b,c,d) { | |
return c*(t/d)+b; | |
}, | |
callback: function () { | |
if (spinner.is(':visible')) { | |
spin(); | |
} | |
} | |
}); | |
}; | |
spin(); | |
this._loginScript("http://"+encodeURIComponent(username)+":"+ | |
encodeURIComponent(password)+"@stream.magnatune.com", { | |
success: function () { | |
Magnatune.Player.hideCredentials(); | |
}, | |
error: function () { | |
spinner.hide(); | |
Magnatune.Player._showCredentials(); | |
} | |
}); | |
}, |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
For a description on what this is about see: http://hackworthy.blogspot.co.at/2012/05/cross-site-http-auth-via-javascript.html