Import from DocumentCloud about overview-server HOT 2 CLOSED

After a long effort with workers, I found some browser bugs with JSONP and HTTP Basic Authentication that are impossible to work around:

• When you enter a wrong username/password in Google Chrome, authentication will fail--and then Google will provide the correct username/password you entered in a previous browser session. This is clearly a bug: if you browse to the page itself, Chrome prompts for credentials. https://code.google.com/p/chromium/issues/detail?id=147627&thanks=147627&ts=1347302705 -- the outcome is that the user sees projects and can import them, but the wrong password is set so the resulting DocumentSet has 0 documents.
• When you enter the correct username/password in Firefox, a prompt pops up over the main page asking you to save the username/password. This is confusing. I think it's prompting the user to remember the "username" and "password" fields for documentcloud.org, which is wrong. It may be prompting the user to remember the "documentcloud_email" and "documentcloud_password" fields for overviewproject.org, which would be okay.

Anyway, there is no workaround for Chrome: it will give false positives no matter how we create our requests.

The solution: XmlHttpRequest. We can set the "Authorization" header ourselves; if that fails, DocumentCloud returns a 403 error (not a 401), so Chrome won't even be tempted to exhibit its bug.

The problem with that solution is that DocumentCloud needs to be configured to accept XHR requests. That means it needs to respond to HTTP "OPTIONS" requests for certain API endpoints. I submitted a pull request: documentcloud/documentcloud#32

Believe it or not, this is less code than we'd otherwise need.

from overview-server.

This works.

from overview-server.