Question

In a Couchapp, I would like to have a login form that works without Javascript.

The wiki page about the Session API states that one can provide a next parameter to _session to be redirected after authentication success or failure.

This sounds great and I would like to redirect to a show function that can then check the user’s credentials and display something accordingly.

I tried using a form:

<form action="/_session" method="POST">
  <input type="text" name="name">
  <input type="password" name="password">
  <input type="hidden" name="next" value="/somewhere">
  <input type="submit">
</form>

as well as using curl:

curl -X POST http://localhost:5984/_session -d 'name=foo&password=bar&next=/somewhere'

but without success: I keep receiving code 200 (OK) if my credentials are correct and code 401 (Unauthorized) if they are not, but I never get the 302 (Redirection) that I expect.

Is this feature gone (I’m using Couchdb 1.1) or am I doing it the wrong way?

If this feature does not exist anymore, do you have an alternative?

Answer 1

After browsing through the source code, it looks like the feature was implemented in v1.1.0.

See the next parmeter implementation in the CouchDB source code.

The parameter is only supported as a query string, not as a form field submission. Thus if you POST to /_session?next=/somewhere with the form data in the POST body, it will work.

curl -i https://example.iriscouch.com/_session?next=/stuff -d 'name=me&password=secret'
HTTP/1.1 302 Moved Temporarily
Set-Cookie: AuthSession=[cookie value]; Version=1; Path=/; HttpOnly
Server: CouchDB/1.1.0 (Erlang OTP/R14B03)
Location: http://example.iriscouch.com/stuff
Date: Tue, 19 Jul 2011 01:07:52 GMT
Content-Type: text/plain;charset=utf-8
Content-Length: 52
Cache-Control: must-revalidate

{"ok":true,"name":"me","roles":["whoever"]}