How do you communicate with a website that requires HTTP basic authentication when building AIR with Flex 3 or Flash CS3? Take 饭否http://fanfou.com/home — the username contains an @ sign, and if you go straight to http://“+loginName+”:”+loginPass+”@api.fanfou.com/statuses/update.xml, you get an ioErr. I asked about this on Blueidea once and I’m still waiting for a reply. I searched online too, but most of what I found talks about how to configure server-side authentication, not how a client logs in… Someone asked about the login approach in C# and Java, but no answer there either. The only usable information was for VB and JS — with Ajax it’s easy, since the XML open method takes user and password parameters.
Last year I scanned through the Flex code line by line and found that URLRequest has a setLoginCredentials method. Add the line urlR.setLoginCredentials(loginName,loginPass); and it will send the user credentials.
Now that the new version of AIR has been released, that method is deprecated again. Since I never had the time to update the Fanfou AIR client I wrote last year, I didn’t pay much attention to it. Today I went to the official site and dug into it. The replacement:
No question about it — you still use URLRequest for the request, but in AIR you can use the public class URLRequestDefaults from the flash.net package. This thing has the static method setLoginCredentialsForHost(hostname:String, user:String, password:String):*, which sets the default username and password credentials for a given host.
Setting the default URLRequest
The URLRequestDefaults class lets you define default settings for URLRequest objects. For example, the code below sets default values for the manageCookies and useCache properties:
URLRequestDefaults.manageCookies = false; URLRequestDefaults.useCache = false;
The URLRequestDefaults class includes a setLoginCredentialsForHost() method that lets you specify a default username and password to use for a particular host. The host given in the function parameters can be a domain name, such as “www.example.com“, or a domain name plus port number, such as “www.example.com:80“. Note that “example.com”, “www.example.com“ and “sales.example.com” are each separate hosts.
These credentials are only used when the server asks for them. If the user has already authenticated (for example, through an authentication dialog), then you can’t change the authenticated user’s identity by calling the setLoginCredentialsForHost() method.
For example, the code below sets a default username and password to use on www.example.com:
URLRequestDefaults.setLoginCredentialsForHost(“www.example.com“, “Ada”, “love1816$X”);
Each property set on URLRequestDefaults applies only to the application domain that sets it. However, the setLoginCredentialsForHost() method applies to all application domains in an AIR application. That way, an application with credentials set can log in to a host and have access to everything in the application it logs into.
(My translation may contain errors — corrections welcome.)