-1

I believe that there's a number of questions here that cover similar areas, however, I couldn't find a concrete answer to my problem.

I am trying to programmatically (in Javascript) access an IP camera that is protected by basic HTTP authentication. My first attempt to achieve this was to add the credentials in the URL, but when this failed I read that browsers might strip the credentials for security reasons. I am on Chrome 90 and will see this as the benchmark required to work.

My next attempt was to do a GET request with an Authorization header field, placing the username and password there:

var xhr = new XMLHttpRequest();
xhr.open('GET', 'http://myurl/');
xhr.setRequestHeader('Authorization', "Basic " + btoa("username:password"));
xhr.send();

This also fails, stating

[...] blocked by CORS policy: Request header field authorization is not allowed by Access-Control-Allow-Headers in preflight response.

I don't have access to the server, so I cannot add any header fields. My next attempt was

var xhr = new XMLHttpRequest();
xhr.withCredentials = true;
xhr.open('GET', 'http://myurl/', true, username, password);
xhr.send();

which fails with the message

[...] blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.

Again, I won't be able to manipulate this value.

Now I am stuck between all those methods, where each seems to fail for its own reason. Can anyone give me a crucial clue on how to achieve a basic HTTP authentication within the described environment? Or am I chasing a ghost here?

lz129
  • 21
  • 4
  • I think, you are chasing a ghost. CORS policy is simply mean, you server is configured in a way that it won't allow third parties to do any such things. So you need to add your website url in the server configuration stating okay anything coming from this URL is my known party , allow all the action for it. Then this problem will go permanently. This is the right fix for this issue. – Abhinav Kumar Apr 27 '21 at 06:06

1 Answers1

-1

The easiest way to get around CORS problems is to make the request server side instead of client side.

Cliff Christianson
  • 1
  • 1
  • 1
    This ain't much help, since I have no server side access (as stated)... – lz129 Apr 27 '21 at 06:01
  • Sorry, I thought you meant no access to the camera server, not that you cannot create or access any server. If you can create a server, you can get better errors as to what the problem is. – Cliff Christianson Apr 27 '21 at 06:11