title: Should the browser cache HTTP Auth credentials sent via Ajax?
body: <p>I am building a static website with restricted access. I have configured the server to protect a subfolder (say www.example.com/restricted) with HTTP Basic Auth.
  Now, I do not want to use the standard browser popup for the login, since it's ugly and does not remember the password across sessions. And it's ugly, did I mention that? =)</p>
  
  <p>So, I am showing a html form, and try to do the authentication via JavaScript (here, with help of jQuery, but the "raw" version showed the same behaviour). The function I am calling looks like</p>
  
  <pre><code>try_login = function(username, password){
    $.ajax({
        url: '/restricted/login.token',
        method: 'GET',
        beforeSend: function(request) {
            request.setRequestHeader(
               'Authorization', 
               'Basic ' + Base64.encode(username + ':' + password));
        },
        success: function () { window.location='/restricted/'; },
        error: function () { $('#error_message').text("Wrong password."); }});
  </code></pre>
  
  <p>}</p>
  
  <p>Now, the authentication works for the ajax request. "login.token" is served correctly with status code 200 if I use the correct username and password, and I get a 401 if I don't.</p>
  
  <p>But the browser (I tested Chrome 28 and IE 10) asks again for the credentials following the redirect in the success callback. It does not seem to save the credentials.</p>
  
  <p>Am I doing something wrong, or is this indeed the expected behaviour? If it is, is there a way to cheat? I really think the browser popup is ugly.</p>
  
  <p>Since this is a static site, any authentication scheme required active server-side code is unfortunately not usable here.</p>