Microsoft KB Archive/832414

= XMLHTTP call fails for URLs with embedded user credentials =

Article ID: 832414

Article Last Modified on 12/26/2006

-

APPLIES TO


 * Microsoft XML Parser 2.6
 * Microsoft XML Core Services 4.0
 * Microsoft XML Core Services 4.0

-



Note The update that is described in this article is superseded by the update that is described in the following Microsoft Knowledge Base article:

887606 MSXML uses cached credentials incorrectly



SYMPTOMS
You make XMLHTTP calls with the following formats: Xmlhttp.open(&quot;GET&quot;, &quot;http://someone:mypass@www.northwindtraders.com/default.asp&quot;, false, &quot;&quot;, &quot;&quot;); Xmlhttp.open(&quot;GET&quot;, &quot;http://someone:mypass@www.northwindtraders.com/default.asp&quot;, false, &quot;someone&quot;, &quot;passwd&quot;); Xmlhttp.open(&quot;GET&quot;, &quot;http://www.northwindtraders.com/default.asp&quot;, false, &quot;someone&quot;, &quot;mypass&quot;); The call fails, and you receive the following error message:

Invalid Syntax Error

However, the following call is successful: Xmlhttp.open(&quot;GET&quot;, &quot;http://www.northwindtraders.com/default.asp&quot;, false, &quot;&quot;, &quot;&quot;);



CAUSE
The Microsoft Internet Explorer security update that is described in the following Microsoft Knowledge Base article bans URLs with embedded user credentials:

832894 MS04-004: Cumulative Security Update for Internet Explorer

.



MORE INFORMATION
Even after you apply the fix that is provided in this article, XMLHTTP calls with URLs in the following formats still fail. Xmlhttp.open(&quot;GET&quot;, &quot;http://someone:mypass@www.northwindtraders.com/default.asp&quot;, false); Xmlhttp.open(&quot;GET&quot;, &quot;http://someone:mypass@www.northwindtraders.com/default.asp&quot;, false, &quot;someone&quot;, &quot;passwd&quot;); You must apply the fix, and you must also change the URL to the following format. Xmlhttp.open(&quot;GET&quot;, &quot;http://www.northwindtraders.com/default.asp&quot;, false, &quot;someone&quot;, &quot;mypass&quot;);



RESOLUTION
A supported fix is now available from Microsoft. This fix will only enable the scenario where user credentials are passed as parameters in the Open method call. This fix will not enable scenarios where the user credentials are embedded in the URL.

Note This fix is only for the following versions of the Microsoft XML Parser (MSXML):
 * Microsoft XML 2.6
 * Microsoft XML 3.0 Service Pack 2
 * Microsoft XML 3.0 Service Pack 3
 * Microsoft XML 3.0 Service Pack 4
 * Microsoft XML 4.0 Service Pack 2

For additional information about how to obtain the updated files and for additional details, click the following article number to view the article in the Microsoft Knowledge Base:

887606 MSXML uses cached credentials incorrectly



WORKAROUND
To work around this problem, use the following format. Xmlhttp.open(&quot;GET&quot;, &quot;http://www.northwindtraders.com/default.asp&quot;, false, &quot;&quot;, &quot;&quot;);



STATUS
Microsoft has confirmed that the scenario where user credentials are passed as parameters in the Open method call and are not embedded in the URL, is a problem in the Microsoft products that are listed in the &quot;Applies to&quot; section.

