Tracking users with Basic Auth

Update: Amit Klein, being the very thorough expert that he is, pointed out that method #2 below has previously been used in the wild. And that #3 might not actually work in IE, RSnake was experiencing some strange caching issue he and Amit are working our the details on.

Thanks to RSnake for helping me test this one. Some users configure their web browsers to block cookies entirely or least for certain websites (like banner providers). They’re attempting to protect their privacy, imagine that. Anyway, there seems to be a way to track users with Basic Auth instead of cookies. Here’s a walk through of the concept:

1) User visits a websiteA where they are blocking its cookies.

2) websiteA delivers a web page with some JavaScript code that silently forces the browser to Basic Auth to the web server with a specific username and password. Think of the u/p as nothing more than a session ID as the web server will authenticate anything sent.

Depending on the browser, either of these methods below could work and will cache the u/p.

Firefox Only
<* img src="http://session:ID@website/">

or

Firefox or Internet Explorer

function forceBasic Authentication() {
var req = null;
var req = new XMLHttpRequest();
if (!req) { req = new ActiveXObject("Msxml2.XMLHTTP"); }
if (!req) { req = new ActiveXObject("Microsoft.XMLHTTP");}
req.open('GET', 'http://website/', false, 'Session', ‘ID’);
req.send(null);
}

Internet Explorer Only

function forceBasic Authentication() {
var req = null;
var req = new XMLHttpRequest();
if (!req) { req = new ActiveXObject("Msxml2.XMLHTTP"); }
if (!req) { req = new ActiveXObject("Microsoft.XMLHTTP");}
req.open('GET', 'http://website/', false);
req.setRequestHeader("Authorization", "Basic nQzw==");
req.send(null);
}

3) Once the browser is authenticated, after receiving a 401, the browser will cache the u/p and send it with each subsequent HTTP request. The benefit of this method is that there is no way to block Basic Auth forced in this way and the user receives no standard Basic Auth pop-up.