JavaScript：获取NTLM用户名？

Question

Can JavaScript get the NTLM username of a user viewing a webpage?

I'm writing a web app that I want to use as part of an intranet, but I'd like to host it in the cloud (behind an Apache password).

Security isn't a big issue: convenience is. I'd like to pick up my intranet users' NTLM usernames directly from the browser, without asking them to reconfigure their browsers or install any extra software. (Note that I don't need passwords, just usernames.)

Or would this be a giant security hole?

Thanks!

Answer 1

I think, this will not work without a web-application in between because if i remember correctly NTLM is sent in a html header which you could access through javascript i think. But you won't get the username because ntlm uses a Challenge-Response method to ensure that the user is trusted. And if this would be possible, everyone could use javascript to fake the username and access your protected data.