XMLHttpRequest (XHR)

xmlhttprequest (xhr) objects are used to interact with servers you can retrieve data from a url without having to do a full page refresh this enables a web page to update just part of a page without disrupting what the user is doing xhr requests might be done silently without causing the browser to refresh/redirect, hence when multiple auto login credentials are found, they might not be displayed on the page making users to think the page is unresponsive to tackle this issue, http proxy intercepts xhr requests and displays the credentials on a pop up after the xhr response is retrieved with multiple credentials (http 409 conflict) http response modification post url and http response modification replacer value element type properties should be set for the intended devices to enable that feature http response modification post url must must point to either a js or html resource on the page where the login is performed when http proxy matches the resource pointed by http response modification post url value, it will make the injection to intercept xhr requests in addition, http response modification replacer valu e value must be set to the constant value ${scautologin} which will cause the actual injection for displaying the multi credential pop up the first sample properties for the kron pam portal login page (html resource) are as follows property name property value http response modification post url /portal ui/x/login/ http response modification replacer value ${scautologin} the second sample properties for the kron pam portal login page (js resource) are as follows property name property value http response modification post url /js/app/login js http response modification replacer value ${scautologin} the second sample properties for the kron pam portal login page (js resource) are as follows property name property value http response modification post url /js/app/login js http response modification replacer value ${scautologin} note the difference between the urls defined for html and js resources both html and js resources are loaded on the login page, so it doesn't matter which resource to use for injection both definitions above are correct and can be used the correct auto login configurations must be predefined for the user selection screen to pop up