sharepoint form认证下跨域访问其他基本认证的系统（客户端用js的xmlhttprequest）的方法

只想到客户端的，而且不是很安全，因为直接用js传了用户名密码。希望高手能指点一二。而且如果能从服务器端解决问题就更好了！

代码//获取数据

var Request = new Object();

Request.send = function(url, method, callback, data, urlencoded,uid,pwd) {

var req;
if (window.XMLHttpRequest) {//非IE内核浏览器
req = new XMLHttpRequest();
}
else if (window.ActiveXObject) {//IE内核浏览器
try {//IE6.0
req = new ActiveXObject("Microsoft.XMLHTTP");
}
catch (e1) {
try {
req = new ActiveXObject("MSXML2.XMLHTTP");
}
catch (e2) {
try {
req = new ActiveXObject("MSXML3.XMLHTTP");
}
catch (e3) {
alert("创建Ajax失败：" + e3)
}
}
}
}
else {//未知浏览器
alert("未能识别的浏览器");
}

req.onreadystatechange = function() {
if (req.readyState == 4) {// only if req shows "loaded"
if (req.status < 400) {// only if "OK"
(method == "POST") ? callback(req) : callback(req, data);
} else {
//alert("There was a problem loading data :\n" + req.status+ "/" + req.statusText + "\n" + url);
}
}
}
// debugger;
if (method == "POST") {
req.open("POST", url, true,uid,pwd);
if (urlencoded) req.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
req.send(data);
} else {
req.open("GET", url, true,uid,pwd);
req.send(null);
}

return req;
}

Request.sendRawPOST = function(url, data, callback) {
Request.send(url, "POST", callback, data, false);
}
Request.sendPOST = function(url, data, callback,uid,pwd) {
Request.send(url, "POST", callback, data, true,uid,pwd);
}
Request.sendGET = function(url, callback, args) {
return Request.send(url, "GET", callback, args);
}

//直接跳转到页
function GetRC(url, username, password) {

var req_oa;

if (window.XMLHttpRequest) {//非IE内核浏览器
req_oa = new XMLHttpRequest();
}
else if (window.ActiveXObject) {//IE内核浏览器
try {//IE6.0
req_oa = new ActiveXObject("Microsoft.XMLHTTP");
}
catch (e1) {
try {
req_oa = new ActiveXObject("MSXML2.XMLHTTP");
}
catch (e2) {
try {
req_oa = new ActiveXObject("MSXML3.XMLHTTP");
}
catch (e3) {
alert("创建Ajax失败：" + e3)
}
}
}
}
else {//未知浏览器
alert("未能识别的浏览器");
}

req_oa.open("POST", url, true, username, password);

req_oa.onreadystatechange = function Result() {

if (req_oa.readyState == 4) {// only if req shows "loaded"
if (req_oa.status < 400) {// only if "OK"
self.location = url;
}
else {
//alert("There was a problem loading data :\n" + req.status+ "/" + req.statusText + "\n" + url);
}
}
}
req_oa.send(null);
}