Do not ask for credentials if user is not authenticated

Question

I have a system with two sites in the same domain. The two sites are in separate folders of the same domain, more or less like this:

http://renan/foo
http://renan/bar

The first site (let’s call it "foo") has a page that accesses data from the other site ("bar") via Ajax. When the user is logged in to both, everything happens as wish. But when the user is logged in only at foo, the browser shows a prompt asking for username and password. Authentication is done via Active Directory and not all users of each site should have access to each other.

I would like it in case the user is logged in to foo nas not in bar, the login prompt did not appear. I wanted to treat it as an error. Is there any way to verify that the system would ask for authentication and prevent the prompt from appearing?

Follow a snippet of the code I’m using for requisition:

$.ajax({
    headers: {
        "accept": "application/json;odata=verbose",
        "content-type": "application/json;odata=verbose"
    },
    type: "GET",
    url: "http://renan/bar/baz",
    beforeSend: function (xhr) {
        xhr.withCredentials = true;
    }
})

Answer 1

I’ve had similar problems...

Unfortunately after long lost searching for a solution, I came to the conclusion that I had nothing to do because - in my case - it is a windows authentication, managed by the application pool.

I had the option to change the whole login mechanism and make my applications manage the authentication - whether by cookie, bank, etc. But since time was short, I decided to put the applications in the same pool.

Answer 2

Maybe you can intercept the message with the done jquery ajax method, as follows:

$.ajax({
    headers: {
        "accept": "application/json;odata=verbose",
        "content-type": "application/json;odata=verbose"
    },
    type: "GET",
    url: "http://renan/bar/baz",
    beforeSend: function (xhr) {
        xhr.withCredentials = true;
    }
}).done(function (data) {
    // avoid response and use your own behavior
}).error(function (xhr) {
    // Treat the error.
});