gecko-dev/toolkit/components/thumbnails/test/authenticate.sjs

function handleRequest(request, response)
{
  try {
    reallyHandleRequest(request, response);
  } catch (e) {
    response.setStatusLine("1.0", 200, "AlmostOK");
    response.write("Error handling request: " + e);
  }
}


function reallyHandleRequest(request, response) {
  var match;
  var requestAuth = true, requestProxyAuth = true;

  // Allow the caller to drive how authentication is processed via the query.
  // Eg, http://localhost:8888/authenticate.sjs?user=foo&realm=bar
  // The extra ? allows the user/pass/realm checks to succeed if the name is
  // at the beginning of the query string.
  var query = "?" + request.queryString;

  var expected_user = "", expected_pass = "", realm = "mochitest";
  var proxy_expected_user = "", proxy_expected_pass = "", proxy_realm = "mochi-proxy";
  var huge = false, plugin = false, anonymous = false;
  var authHeaderCount = 1;
  // user=xxx
  match = /[^_]user=([^&]*)/.exec(query);
  if (match)
    expected_user = match[1];

  // pass=xxx
  match = /[^_]pass=([^&]*)/.exec(query);
  if (match)
    expected_pass = match[1];

  // realm=xxx
  match = /[^_]realm=([^&]*)/.exec(query);
  if (match)
    realm = match[1];

  // proxy_user=xxx
  match = /proxy_user=([^&]*)/.exec(query);
  if (match)
    proxy_expected_user = match[1];

  // proxy_pass=xxx
  match = /proxy_pass=([^&]*)/.exec(query);
  if (match)
    proxy_expected_pass = match[1];

  // proxy_realm=xxx
  match = /proxy_realm=([^&]*)/.exec(query);
  if (match)
    proxy_realm = match[1];

  // huge=1
  match = /huge=1/.exec(query);
  if (match)
    huge = true;

  // plugin=1
  match = /plugin=1/.exec(query);
  if (match)
    plugin = true;

  // multiple=1
  match = /multiple=([^&]*)/.exec(query);
  if (match)
    authHeaderCount = match[1]+0;

  // anonymous=1
  match = /anonymous=1/.exec(query);
  if (match)
    anonymous = true;

  // Look for an authentication header, if any, in the request.
  //
  // EG: Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
  // 
  // This test only supports Basic auth. The value sent by the client is
  // "username:password", obscured with base64 encoding.

  var actual_user = "", actual_pass = "", authHeader, authPresent = false;
  if (request.hasHeader("Authorization")) {
    authPresent = true;
    authHeader = request.getHeader("Authorization");
    match = /Basic (.+)/.exec(authHeader);
    if (match.length != 2)
        throw "Couldn't parse auth header: " + authHeader;

    var userpass = base64ToString(match[1]); // no atob() :-(
    match = /(.*):(.*)/.exec(userpass);
    if (match.length != 3)
        throw "Couldn't decode auth header: " + userpass;
    actual_user = match[1];
    actual_pass = match[2];
  } 

  var proxy_actual_user = "", proxy_actual_pass = "";
  if (request.hasHeader("Proxy-Authorization")) {
    authHeader = request.getHeader("Proxy-Authorization");
    match = /Basic (.+)/.exec(authHeader);
    if (match.length != 2)
        throw "Couldn't parse auth header: " + authHeader;

    var userpass = base64ToString(match[1]); // no atob() :-(
    match = /(.*):(.*)/.exec(userpass);
    if (match.length != 3)
        throw "Couldn't decode auth header: " + userpass;
    proxy_actual_user = match[1];
    proxy_actual_pass = match[2];
  }

  // Don't request authentication if the credentials we got were what we
  // expected.
  if (expected_user == actual_user &&
    expected_pass == actual_pass) {
    requestAuth = false;
  }
  if (proxy_expected_user == proxy_actual_user &&
    proxy_expected_pass == proxy_actual_pass) {
    requestProxyAuth = false;
  }

  if (anonymous) {
    if (authPresent) {
      response.setStatusLine("1.0", 400, "Unexpected authorization header found");
    } else {
      response.setStatusLine("1.0", 200, "Authorization header not found");
    }
  } else {
    if (requestProxyAuth) {
      response.setStatusLine("1.0", 407, "Proxy authentication required");
      for (i = 0; i < authHeaderCount; ++i)
        response.setHeader("Proxy-Authenticate", "basic realm=\"" + proxy_realm + "\"", true);
    } else if (requestAuth) {
      response.setStatusLine("1.0", 401, "Authentication required");
      for (i = 0; i < authHeaderCount; ++i)
        response.setHeader("WWW-Authenticate", "basic realm=\"" + realm + "\"", true);
    } else {
      response.setStatusLine("1.0", 200, "OK");
    }
  }

  response.setHeader("Content-Type", "application/xhtml+xml", false);
  response.write("<html xmlns='http://www.w3.org/1999/xhtml'>");
  response.write("<p>Login: <span id='ok'>" + (requestAuth ? "FAIL" : "PASS") + "</span></p>\n");
  response.write("<p>Proxy: <span id='proxy'>" + (requestProxyAuth ? "FAIL" : "PASS") + "</span></p>\n");
  response.write("<p>Auth: <span id='auth'>" + authHeader + "</span></p>\n");
  response.write("<p>User: <span id='user'>" + actual_user + "</span></p>\n");
  response.write("<p>Pass: <span id='pass'>" + actual_pass + "</span></p>\n");

  if (huge) {
    response.write("<div style='display: none'>");
    for (i = 0; i < 100000; i++) {
      response.write("123456789\n");
    }
    response.write("</div>");
    response.write("<span id='footnote'>This is a footnote after the huge content fill</span>");
  }

  if (plugin) {
    response.write("<embed id='embedtest' style='width: 400px; height: 100px;' " + 
           "type='application/x-test'></embed>\n");
  }

  response.write("</html>");
}


// base64 decoder
//
// Yoinked from extensions/xml-rpc/src/nsXmlRpcClient.js because btoa()
// doesn't seem to exist. :-(
/* Convert Base64 data to a string */
const toBinaryTable = [
    -1,-1,-1,-1, -1,-1,-1,-1, -1,-1,-1,-1, -1,-1,-1,-1,
    -1,-1,-1,-1, -1,-1,-1,-1, -1,-1,-1,-1, -1,-1,-1,-1,
    -1,-1,-1,-1, -1,-1,-1,-1, -1,-1,-1,62, -1,-1,-1,63,
    52,53,54,55, 56,57,58,59, 60,61,-1,-1, -1, 0,-1,-1,
    -1, 0, 1, 2,  3, 4, 5, 6,  7, 8, 9,10, 11,12,13,14,
    15,16,17,18, 19,20,21,22, 23,24,25,-1, -1,-1,-1,-1,
    -1,26,27,28, 29,30,31,32, 33,34,35,36, 37,38,39,40,
    41,42,43,44, 45,46,47,48, 49,50,51,-1, -1,-1,-1,-1
];
const base64Pad = '=';

function base64ToString(data) {

    var result = '';
    var leftbits = 0; // number of bits decoded, but yet to be appended
    var leftdata = 0; // bits decoded, but yet to be appended

    // Convert one by one.
    for (var i = 0; i < data.length; i++) {
        var c = toBinaryTable[data.charCodeAt(i) & 0x7f];
        var padding = (data[i] == base64Pad);
        // Skip illegal characters and whitespace
        if (c == -1) continue;
        
        // Collect data into leftdata, update bitcount
        leftdata = (leftdata << 6) | c;
        leftbits += 6;

        // If we have 8 or more bits, append 8 bits to the result
        if (leftbits >= 8) {
            leftbits -= 8;
            // Append if not padding.
            if (!padding)
                result += String.fromCharCode((leftdata >> leftbits) & 0xff);
            leftdata &= (1 << leftbits) - 1;
        }
    }

    // If there are any bits left, the base64 string was corrupted
    if (leftbits)
        throw Components.Exception('Corrupted base64 string');

    return result;
}