Question

I’m logging into an application on a separate domain and, for each subsequent XmlHttpRequest I make to that domain, I want to send the Windows Authentication credentials so I’m not prompted to login again if I make a request to a separate service on that same domain.

Is it possible to send Windows Authentication credentials in an XmlHttpRequest header?

var xmlhttp = new window.XMLHttpRequest();
xmlhttp.open("GET", requestUrl, true);
xmlhttp.setRequestHeader("Content-Type", "application/json");
xmlhttp.setRequestHeader("Accept", "application/json");

//Is it possible to send the Windows Authentication creds in the header of this request?
xmlhttp.setRequestHeader("?????", "?????");

xmlhttp.onreadystatechange = function ()
{
    if (xmlhttp.readyState == 4)
    {
        callback(__parseJson(xmlhttp.responseText));
    }
}
xmlhttp.send(null);

Answer 1

You’ll have to log in using the login domain for each initial request to the different domain. Because the requests are going to a different service then IIS treats it as an initial request and will prompt for the login.