Why doesn’t the browser reuse the authorization headers after an authenticated XMLHttpRequest?
Basic idea Load the images via JavaScript and display them on the site. The advantage is that the authentication credentials will never find their way into the HTML. They will resist at the JavaScript side. Step 1: load the image data via JS That’s basic AJAX functionality (see also XMLHttpRequest::open(method, uri, async, user, pw)): var … Read more