So I’m working on the web side of a mobile + web app and I’m running into an issue where a request to sync gateway makes the browser do its Basic Authorization prompt dialog if there isn’t a valid session.
What I wanted to do was have the app make a call (via swagger) to whatever endpoint the user needs for that part of the app, and if it throws back 401 unauthorized, update the state in the app to bring the user back to the login page clear the old cookie etc .
How do I do web authentication without running into this weird browser popup?
Put sync gateway behind nginx proxy and tweak the responses if its 401 so that the browser won’t do the popup?
Maybe there’s some way to disable the basic auth headers in config file?
I’m running react, redux, swagger, and the sync gateway is on different host so requests are using CORS.
I’ve found a similar topic but not really a solution
If I enable guest user like in their solution, I’m still not sure how to programmatically determine whether the user needs to log back in.
How do you guys normally handle old/non-existent sync gateway sessions in web app?
It seems wrong to me that the browser would pop up a password alert when an XHR gets a 401, but there are probably complicated reasons for it.
I know that CouchDB deliberately breaks its 401 responses, by omitting the required WWW-Authentication: header, for exactly this reason. We didn’t do that in SG. But as you point out, you can use a proxy to do the same workaround.