# Optional authentication and HTTP Basic

**URL:** <https://www.ruby-forum.com/t/optional-authentication-and-http-basic/157560>\
**Category:** Rails\
**Created:** [January 13, 2009, 5:02am UTC](https://www.ruby-forum.com/t/optional-authentication-and-http-basic/157560 "2009-01-13T05:02:02Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ISESSmith-Heister](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/ea666f/32.png) [@ISESSmith-Heister](https://www.ruby-forum.com/u/ISESSmith-Heister)\
**Post date:** [January 13, 2009, 5:02am UTC](https://www.ruby-forum.com/t/optional-authentication-and-http-basic/157560/1 "2009-01-13T05:02:02Z")

</div>

Hi all,

I have an app that originally only supported form-based  
authentication, and showed pared-down content to unauthenticated  
users. I then layered on HTTP Basic authentication using  
authenticate\_with\_http\_basic, which worked fine for scripts like LWP/  
wget/curl.

However, some web browsers refuse to submit credentials in the URL  
(eg. [http://username:removed\_email\_address@domain.invalid](http://username:removed_email_address@domain.invalid)) since they never get a  
challenge (401) response, since authentication is purely optional.  
This is a bigger problem than one might expect, since there’s a  
desktop client in development that requires the ability to login with  
HTTP Basic URL auth.

They way I hacked around it was to create an action that looks like  
this:

app/controllers/sessions\_controller.rb  
def challenge  
authenticate\_or\_request\_with\_http\_basic APP\_NAME do |login,  
password|  
@user = User.authenticate(login, password)  
end  
if @user  
self.current\_user = @user  
render\_ok  
end  
end

so browser clients (including the problematic desktop client) can GET  
[http://user:removed\_email\_address@domain.invalid/sessions/challenge](http://user:removed_email_address@domain.invalid/sessions/challenge) to do explicit HTTP  
basic auth.

Is there a better way to do this?

Thanks,  
Ian