Login using AJAX?

[paladin.rithe]

I'm looking to use AJAX as part of the login system for a project, but
I'm not finding what I'm looking for. I've seen the example of how to
do an AJAX login, but that isn't really what I want.
What I want to do is use XMLHttpRequest to send the request, and send
back any errors (no username, bad password, whatever). But, if it is a
valid account, I'd like it to login to the system. I haven't been able
to find anything like that, and I'm not positive it's possible. I'm
using PHP as the backend, and I do have a working login, so that's not
the problem. The issue is more of, how can I get it to not change the
page if there's an error, but if it's a valid login, go to a different
page.
I hope I explained it well enough.

 

[ASM]

(e-mail address removed) a écrit :

I'm looking to use AJAX as part of the login system for a project, [...]
The issue is more of, how can I get it to not change the
page if there's an error, but if it's a valid login, go to a different
page.
I hope I explained it well enough.

Yes.
Very interesting problem.

I think answer is not very far from usual way to do with "normal"
javascript and/or "normal" php.

I will suppose that your XHR is called from onsubmit of your form, and
this form is completely redrawn by XHR.responseText.

If all correct you just need to redraw this form without onsubmit and
with a modified submit button : i.e. [Enter] instead of [Validate]

On this last press on submit button the form is finally send to PHP via
form's action and welcome page sent back.

 

[ASM]

ASM a écrit :

I think answer is not very far from usual way to do with "normal"
javascript and/or "normal" php.

JS :
====
http = false;
function myXHR() { blah to return http = XLMHttpRequest }
function logger(f) {
var verif = 'pseudo='+f.pseudo.value+'&pass='+f.pass.value;
http = myXHR();
http.open("GET", 'valid.php' + escape(verif), true);
http.onreadystatechange = handleHttpResponse;
http.send(null);
}
handleHttpresponse() {
if (http.readyState == 4) {
results = http.responseText.split(",");
if(result[0]=='ok') return true;
else {
document.getElementById('alert').innerHTML = results[1];
return false;
}
}
}

HTML :
======
<form action="enter.php" onsubmit="return logger(this);" method="post">
<h3 id="alert"></h3>
<p>Pseudo : <input name="pseudo" ...

PHP (file 'valid.php') :
========================
analyze pseudo and pass with MySql
if pseudo is false -> echo 'false,Pseudo is not correct';
if pass is false -> echo 'false,Password is not correct';
else if pass and pseudo are correct -> echo 'ok,';


This time no need to modify submit-button nor to redraw all form.

 

[kday33]

They do what I think you want to do at reddit.com. Try voting for a
link when you're not logged in and it gives a menu that lets you log in
or even create a new account. I'm sure they use AJAX for it. It even
gives back an error message if it's an incorrect password.

 

[eggie5]

Ignoring any server side login problems your having, the first thing I
have to say is that you sending your passwords in plain text!!! you
need to AT LEAST encrypt them before sending them to the server for
validation!! look into doing a "HMAC" login system. You can use this js
below:

http://pajhome.org.uk/crypt/md5/auth.html

I use it on my site w/ ajax and it's pretty cool.

I get my password hash like this:
var hash= hex_hmac_sha1(password, challenge);

then I send it to the async. server. then on the server (asp.net) I
recompute the hash with the known key and if they match, the login was
successfull.

 

[ASM]

ASM a écrit :

ASM a écrit :
handleHttpresponse() {

Ooops! handleHttpResponse()


handleHttpResponse() {
if (http.readyState == 4) {
results = http.responseText;
if(results=='ok') return true;
else {
document.getElementById('alert').innerHTML = results;
return false;
}
}
}

HTML :
======
<form action="enter.php" onsubmit="return logger(this);" method="post">
<h3 id="alert">&nbsp;</h3>
<p>Pseudo : <input name="pseudo" ...

PHP (file 'valid.php') :
========================
analyze pseudo and pass with MySql
if pseudo is false -> echo 'Pseudo is not correct';
if pass is false -> echo 'Password is not correct';
else if pass and pseudo are correct -> echo 'ok';

 

[paladin.rithe]

Yeh, I was going to encrypt stuff. I'm just trying things out locally
so it doesn't matter at the moment.
I think I didn't explain it well enough. It seems like what you guys
are telling me will do a normal AJAX call (I need to test what you
suggested first though, I haven't had a chance) where it pulls the data
in from main.php, and replaces the appropriate area in the index.php.
I want do basicly do a normal login, where I am login from index.php,
login.php checks the login info, and then in the address bar I'm seeing
main.php. (I have a suspicion that it's not easily possible). But, I
want to receive errors back via an ajax call, so I don't have to reload
the page, but I want it to reload the page with the main.php, not load
it back into the index page.
The only way I can think of doing this is to do a normal ajax call, and
if it's a good login, return a code to signify that. If it is, then
send another call that would load the new page, with a code to verify
that this is a valid call to login. But that is just thinking off the
top of my head, I'm not sure if it's doable yet, let alone if it's
secure or hackable.