Javascript - XMLHttpRequest帖子，使用resonse获取。

Question

这是我的第一个帖子，因为我找不到任何解决我的问题的办法。(google了好几天了)我不是一个程序员，我是一个好的googleer:)

我想用用户名、密码和一些选项登录一个网站。(apiloginBasic)之后我想访问一个网站。(apisitemasterrun)但在这里我得到的信息是："用户没有足够的访问权限"。"User does not have adequate access rights "如果我用浏览器做这个，一切都很好。

我想我需要传递一些Authtoken到Get请求中，但我不知道。

这是我的代码片段。

/这段代码很好用

const toSend = {
    email :"[email protected]",
    force_sm_off: false,   //I have no clue (found from Net Sniffing of the original Application)
    password:"mypassword",
    username:"installer"}

const jsonString = JSON.stringify(toSend)  ;
const xhr = new XMLHttpRequest() ;
process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = 0 //I have no certificate and only access the Site in my local network

xhr.open("POST", "https://192.168.2.77/api/login/Basic",false,"Provider_Engineer","mypassword" ) ;
xhr.setRequestHeader ("Content-Type", "application/json") ;
xhr.withCredentials=true ;
xhr.onreadystatechange = function() {
     const myresponse = JSON.parse(this.responseText) ; //myresponse contains: email, firstname, lastname,    roles: Array(1), token
       var myauth=myresponse.token //Saving Token for further use


   //fine until here

   //Now I'm trying to get the Page

    const xhr1 = new XMLHttpRequest() ;
    process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = 0
    xhr1.open("GET", "https://tesla/api/sitemaster/run",false ) ;
    xhr1.setRequestHeader ("Content-Type", "application/json") ;
    xhr1.setRequestHeader ("credentials", "same-origin") ;
    xhr1.setRequestHeader ("AuthCookie", myauth) ;  //In Browser F12 I can see AuthCookie and Userrecord
    xhr1.onreadystatechange = function() {
         console.log(this.responseText)  //getting Message: User does not have adequate access rights
    }     
    xhr1.send(null)
};
xhr.send(jsonString) ; //Post Request, that is working fine

有什么建议可以让我访问这个网站吗？

RegardsStefan

Answer 1

我想通了。

process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = 0 xhr1.open("GET", "https://tesla/api/sitemaster/run",false ) ;

var myBearer= "Bearer " + myauth ;

xhr1.setRequestHeader ("Authorization", myBearer) ;

发现：通过Javascript发送授权令牌承担者