First of all, I'm not 100% sure what I'm asking is a right thing to do or not. So please free feel to correct me if I'm wrong.  Using Spring Security, I've developed a REST API backend which users can log in using some custom entry. If my users authenticate themselves using my custom API, there will be a session created for them and the rest of API entries will be accessible to them, considering their role and ACL.  At the same time, these APIs are designed so they can provide services to other software. So I thought it makes sense to enable some HTTP Basic Authentication as well. Later on, I might be working on digest as well. And if some request is authenticated using one of these methods, there will be no session created for them. And they'll need re-authenticate for every single request. It's a stateless API.  So far everything is great. The users and other systems can make use of the same sets of APIs. But the problem is when a user's session is expired. Or when some user starts using the backend services before he logs in. In such cases, the right strategy is to redirect the user to a login page and ask them to authenticate themselves. But since I've enabled the HTTP Basic Authentication, calling a REST API which needs authentication (while the user is not authenticated) leads to a browser popup asking for the username and password.  Of course, the user can enter the credentials and keep using the system. But I don't like this way of authentication for my users. First of all, the authentication credentials will stick and I consider it a security risk. They are easily be saved into the browser without informing the user they are. And it's hard to get rid of the saved credentials. The user can leave the computer without even knowing that his username and password are saved.  So my question is, is it possible to have Basic Authentication enabled but at the same time, prevent the browser from knowing it? Or even better, acting on it?  I suspect that if I prevent the WWW-Authenticate response header on the way back, I might be able to do so. But then, I'm not sure of the ramifications of such a decision. Also, I don't know how to remove that header from the response for all of the APIs.
My web application has a login page that submits authentication credentials via an AJAX call. If the user enters the correct username and password, everything is fine, but if not, the following happens:   The web server determines that although the request included a well-formed Authorization header, the credentials in the header do not successfully authenticate. The web server returns a 401 status code and includes one or more WWW-Authenticate headers listing the supported authentication types. The browser detects that the response to my call on the XMLHttpRequest object is a 401 and the response includes WWW-Authenticate headers. It then pops up an authentication dialog asking, again, for the username and password.   This is all fine up until step 3. I don't want the dialog to pop up, I want want to handle the 401 response in my AJAX callback function. (For example, by displaying an error message on the login page.) I want the user to re-enter their username and password, of course, but I want them to see my friendly, reassuring login form, not the browser's ugly, default authentication dialog.  Incidentally, I have no control over the server, so having it return a custom status code (i.e., something other than a 401) is not an option.  Is there any way I can suppress the authentication dialog? In particular, can I suppress the Authentication Required dialog in Firefox 2 or later? Is there any way to suppress the Connect to [host] dialog in IE 6 and later?    Edit Additional information from the author (Sept. 18): I should add that the real problem with the browser's authentication dialog popping up is that it give insufficient information to the user.  The user has just entered a username and password via the form on the login page, he believes he has typed them both correctly, and he has clicked the submit button or hit enter. His expectation is that he will be taken to the next page or perhaps told that he has entered his information incorrectly and should try again. However, he is instead presented with an unexpected dialog box.  The dialog makes no acknowledgment of the fact he just did enter a username and password. It does not clearly state that there was a problem and that he should try again. Instead, the dialog box presents the user with cryptic information like "The site says: '[realm]'." Where [realm] is a short realm name that only a programmer could love.  Web broswer designers take note: no one would ask how to suppress the authentication dialog if the dialog itself were simply more user-friendly. The entire reason that I am doing a login form is that our product management team rightly considers the browsers' authentication dialogs to be awful.
I just reached the 3k rep limit required for close votes and have started exploring the vote-to-close UI that's opened up to me, and I have a request.  The review queue has a Do Not Close button, but when I click the close link under a question that has close votes (i.e. it shows close (1)), there isn't an option for me to vote against closing the question. I came across a question that had a vote to close it as not a question, but it had just been updated with code and more details and was no longer a candidate for closing. However, I couldn't cast a vote to not close it from the question itself. When I clicked on close, it brought up the usual voting UI, and "Do Not Close" was not an option.  TL;DR, do this:   Open a question in the close votes review queue Note the Do Not Close button Click the question title to go to it Click the close (n) link under the question (assuming it hasn't already been closed) Notice the lack of an equivalent "Do Not Close" option   Could a "Do Not Close" option be added to the close button popup for questions that already have close votes, that way the review interface isn't the only place a "Do Not Close" vote can be cast?  Edit: Okay, so 5 3 "Do Not Close" votes kicks it out of the review queue, it doesn't have "no effect" as suggested in the comments. (See , in which the  was just updated a few minutes ago to say 3 DNC votes.) I still don't see why the same DNC option can't be available from the question.  Basically, I guess I would like some rationale behind this bullet point from :     Only accessible from the review queue (so rather difficult to target a specific question). Yes, this is very much by-design. Solve $x=y\frac{dy}{dx}-\left(\frac{dy}{dx}\right)^{2}$ If $\sum a_n$ converges and $b_n=\sum\limits_{k=n}^{\infty}a_k $, prove that $\sum \frac{a_n}{b_n}$ diverges Let $\displaystyle \sum a_n$ be  convergent series of positive terms and set  $\displaystyle b_n=\sum_{k=n}^{\infty}a_k$ , then prove that $\displaystyle\sum \frac{a_n}{b_n}$ diverges.   I could see that $\{b_n\}$ is monotonically decreasing sequence converging to $0$ and I can write $\displaystyle\sum \frac{a_n}{b_n}=\sum\frac{b_n-b_{n+1}}{b_n}$, how shall I proceed further? Moving from HTTP to HTTPS in Google Search Console I'm moving from HTTP to HTTPS for my entire site. The site is currently added to Google Search Console (formerly Google Webmaster Tools) as www.example.com and all the pages are indexed without using SSL.  How do I go about moving to the new HTTPS URLs on Google Search Console?   Do I just submit an updated sitemap which has the HTTPS URLs or do I add a new site as https://www.example.com and submit the sitemap with HTTPS URLs? All current URLs are set to redirect to their HTTPS counterparts. Do I add multiple properties to Google Search Console? Find the exact value of the infinite sum $\sum_{n=1}^\infty \big\{\mathrm{e}-\big(1+\frac1n\big)^{n}\big\}$ Can a plan "age" reach zero? TinyMCE disable escaping How to show full date and time in Nautilus/Files 3.6+ list view? Is it possible to install an old version of Mac OS on a new Mac? I know that Apple doesn't want me to run a version of Mac OS older than the one my Mac came with, but is there a way around this?  For example: if I buy a new Retina MacBook Pro, is there a way to run OS 10.6 on it without a VM? How to prove that $\lim_{n\rightarrow \infty}\frac {n^{2}}{2^{n}}=0$ & $\lim_{n\rightarrow \infty}\frac {n^{2}}{n!}=0$? Prove that:  $$\lim_{n\rightarrow \infty}\dfrac {n^{2}}{2^{n}}=0$$  I think I need to show $2^n \geq n^3$ $\forall n \geq10$. Is it true?  What about: $$\lim_{n\rightarrow \infty}\dfrac {n^{2}}{n!}=0$$  What to do with $n!$? What is the correct way to get a pgfkey value? According to the special theory of relativity, distant simultaneity depends on the observer's reference frame.  And, according to the quantum theory, in the case of two entangled particles, a measure on one of the particles simultaneously affects the second one. Under which reference frame is this simultaneous? Lasso and statistical signficance of selected variables Elements of $\mathbb{F}_p$ having cube roots in $\mathbb{F}_p$ Let $p$ be a prime number, and let $\mathbb{F}_p$ be the field with $p$ elements. How many elements of $\mathbb{F}_p$ have cube roots in $\mathbb{F}_p$?   I had this question on an exam and after reviewing I am still not sure. Any help would be appreciated. Do the laws of physics evolve? There are four coins in the main hallway, and a number of them in the Boos in the yard. Is there anything to gain from them other than health? Do I get anything for collecting them, perhaps in a particular order? Linux / Bash, using ps -o to get process by specific name? Can I transfer my Terraria character from one PC to another? Currently my map server is run on my laptop at home, and my brother and I play via LAN each on his desktop PC.  However, I'd like to transfer my character from the Desktop PC to my laptop in order to play on the go.  Can I do this? Where is the character information saved? Does the fact that matrices $A, B$ are similar imply that $A+cI$ is similar to $B+cI$? Let $A, B$ be similar $n \times n$ matrices over (say) $\mathbb{R}.$  Is it the case that $A+cI$ is similar to $B+cI$?    Here is an argument (which seems too good to be true...)  Since $A, B$ are similar, they have the same Jordan form. So we can write $PAP^{-1}=QBQ^{-1}=J$ for $P, Q$ invertible matrices.   Hence we have $P(A+cI)P^{-1}=PAP^{-1}+cI= J+cI.$ Similarly, we find $Q(B+cI)Q^{-1}=J+cI.$  Hence $A+cI$ and $B+cI$ are both similar to $J+cI$ and hence similar to each other.   Is this correct? Is it possible to redirect connections to a specific IP/port to an external IP/port?  Example:   Server A has the external IP xxx.xxx.xxx.xxx Server B has the external IP yyy.yyy.yyy.yyy User sends a request to server A on port 2106, I want to redirect it to server B at port 2106.