Neil Kandalgaonkar wrote: Using AJAX is not more insecure than normal login using POST (which should be kept for non-js clients). You just need a begin request before the one that transmits the credentials.

I should follow this up with: as discussed on the channel, I love the idea of someone working on AJAX login support. It is perfectly useable by a bunch of third parties, and would be a great addition to the software. Respectfully, Ryan Lane

On 3/25/11 3:20 PM, Aryeh Gregor wrote: With digest authentication you can transmit credentials over unencrypted HTTP without worrying that someone is capturing your plaintext password, say in a log file, and can log in as you later. Ryan is correct that a man in the middle who captured digested credentials could log in as you that one time. But not a subsequent time. So they'd have to do their damage right away. But, if you also bind the session to a particular IP, the attacker has a harder time exploiting this without being detected. I don't have a complete solution thought out, I was just musing that maybe this kind of thing could be useful if we wanted a solution that worked over plain HTTP. But Ryan is also worried about a MITM that corrupts the surrounding page, so that the HTTP-served software that tries to make this HTTPS connection is already compromised. -- Neil Kandalgaonkar (| <neilk(a)wikimedia.org>