Question
Native HTTP basic auth dialog suppression shifts to chromium-args in NW.js 0.48.0
Sky Sage
0 reputation · 10 Mar 2020, 20:06 UTC
118.7K views1
Loading…
0 reputation · 10 Mar 2020, 20:06 UTC
An NW.js application calls a remote endpoint that returns 401 with a WWW-Authenticate header. Chromium displays its native basic-auth dialog, which neither fetch nor XMLHttpRequest can override. The project is upgrading from NW.js 0.47.x to 0.48.x or later, and the supported way to pass Chromium flags changed from a command-line argument to the package.json chromium-args field.
It is uncertain whether --disable-http-auth still works when passed only on the command line after 0.48.0, or whether it must appear exclusively under chromium-args in the manifest. It is also unclear whether omitting the field keeps the native dialog enabled across Windows, macOS, and Linux.
Does NW.js 0.48.0 and later ignore --disable-http-auth when supplied outside package.json? Should chromium-args replace the command-line flag entirely, or can both coexist? Is suppression behavior consistent across operating systems for the same NW.js version?
35775 reputation · 11 Mar 2020, 06:38 UTC
In NW.js 0.48.0 and later, the --disable-http-auth flag must be defined within the package.json manifest under the chromium-args field to reliably suppress the native Chromium basic authentication dialog. Relying solely on command-line arguments for this specific flag is no longer the supported method and may be ignored by the runtime.
To ensure the native dialog is suppressed across all platforms, move the flag from your startup script to your manifest file:
nodewebkit{
"name": "your-app-name",
"main": "index.html",
"chromium-args": "--disable-http-auth"
}Command-line vs. Manifest: While some Chromium flags may still be accepted via the command line, NW.js 0.48.0 shifts the primary configuration of the Chromium engine to the chromium-args field. For flags that affect the browser's core networking and UI behavior—such as HTTP authentication—the manifest is the authoritative source. Using both may lead to unpredictable overrides, but the manifest setting is the priority for stability.
Cross-Platform Consistency: The --disable-http-auth flag operates at the Chromium engine level rather than the OS windowing level. Therefore, once correctly applied via chromium-args, the suppression of the 401-triggered dialog should remain consistent across Windows, macOS, and Linux.
To verify the configuration is active, perform the following test:
package.json.fetch() or XMLHttpRequest to call a remote endpoint that returns a 401 Unauthorized status and a WWW-Authenticate header.Diagnostic Note: If the dialog persists, please specify if you are using a custom build of NW.js or a specific SDK flavor (e.g., Normal vs. SDK), as this can affect how flags are parsed.
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.