LV2012 Web Services w/ NI Auth login not working w/ static files in Firefox 19

Question

Hi!
I followed this procedure to password protect my web service and the static files. 
http://digital.ni.com/public.nsf/allkb/DF41D5DA8EEB4840862577D90058C208
When testing it out with my web service it seems to work fine on any web browser.  http://localhost:8080/add/add/1/2 first will present a login.  Once the user is logged in the page refreshes and the results of the operation are shown.  http://localhost:8080/logout works as well.
I followed the procedure in the FAQ to include an index.html file.
http://www.ni.com/white-paper/7747/en#toc15
When I try to access the page (via http:localhost:8080/add/web/index.html) I'm greeted with the National Instruments login screen.  I enter my credentials and in Chrome and Internet Explorer the screen refreshes and I see my html file.  In Firefox it hangs for awhile on the authentication screen and then reloads back to the authenticaiton screen (as if the username and password did not take).
Attached are my files.  If you want to try and recreate this please follow this procedure:
* Unzip the attached project to a folder
* Open the project in LabVIEW 2012
* Check the properties of the web service to ensure that the build paths are correct
* Follow the procedure above for setting up NI Auth on your web service and adding the "testpermission2" permission.  Be sure to remove "Everyone" from that "testpermission2" or you will never see a login prompt.
* Build/Deploy the web service
* open http://localhost:8080/logout to ensure that you are not currently authenticated
* open http://localhost:8080/add/add/1/2 and login, observe behavior
* open http://localhost:8080/add/web/index.html you should still be logged in so you will see the "Hello World!" just fine
* open http://localhost:8080/logout to log back out
* open http://localhost:8080/add/web/index.html and see if you are able to login.
I've tried disabelling my plugins in Firefox and still have this problem.  I'm really scratching my head on how to overcome this other than throwing away NI Auth and use something else.  My web service is going to run off of a static front end driven by javascript and html.  So the access point will be the html file.  I need to have some username and password scheme worked out.  I also need to be able to see what user is currently logged in with my Web Service VIs (does anyone know if that is possible with NI Auth)? 
The other BIG issue I have with NI Auth is that it requires Silverlight.  So much for mobile support, eh?  Anyone know of a good plug-and-play alternative so I don't have to reinvent the wheel?  I guess I could impliment some kind of token system on my web service side.
In the meantime, getting NI Auth to properly work with Firefox would help.
Thanks for your input,
-Nic
Attachments:
Example Web Service.zip ‏15 KB

Answer 1

Disclaimer: I in no way mean to bash NI and I have used NI Auth myself in the past
If you are going to go to the trouble of abstracting NI Auth, I would recommend instead investing your time in your own authentication scheme (or implementing a standard scheme in LV).
NI Auth is great and works for low security applications where you just don't want people fooling around with your application who shouldn't be.
However, NI Auth is really not that secure.  If I remember correctly, the username is transmitted in plain text and I don't think the encryption algorithm is that sophisticated.  It is nice that it's already integrated into LV, but there really are very few features at this time.
If you want something to be really secure, you need to take measures beyond what NI Auth provides and before you go to the work of building abstraction on top of a basic and somewhat shaky protocol, I'd seriously consider implementing a more stable base.
<insert 2 cents complete>
Chris
Certified LabVIEW Architect
Certified TestStand Architect