girder/web_client/src/auth.js
function login(username, password, cors = corsAuth, otpToken = null) {
    var auth = 'Basic ' + window.btoa(username + ':' + password);

    const headers = {
        'Authorization': auth
    };
    if (_.isString(otpToken)) {
        // Use _.isString to send header with empty string
        headers['Girder-OTP'] = otpToken;
    }
    return restRequest({
        method: 'GET',
        url: '/user/authentication',
        headers: headers,
        error: null
    }).then(function (response) {
        response.user.token = response.authToken;

        setCurrentUser(new UserModel(response.user));
        setCurrentToken(response.user.token.token);

        if (cors && !cookie.find('girderToken')) {
            // For cross-origin requests, we should write the token into
            // this document's cookie also.
            document.cookie = 'girderToken=' + getCurrentToken();
        }

        events.trigger('g:login.success', response.user);
        events.trigger('g:login', response);

        return response.user;
    }).fail(function (jqxhr) {
        events.trigger('g:login.error', jqxhr.status, jqxhr);
    });
}
function login(username, password, cors = corsAuth, otpToken = null) {
    var auth = 'Basic ' + window.btoa(username + ':' + password);

    const headers = {
        'Authorization': auth
    };
    if (_.isString(otpToken)) {
        // Use _.isString to send header with empty string
        headers['Girder-OTP'] = otpToken;
    }
    return restRequest({
        method: 'GET',
        url: '/user/authentication',
        headers: headers,
        error: null
    }).then(function (response) {
        response.user.token = response.authToken;

        setCurrentUser(new UserModel(response.user));
        setCurrentToken(response.user.token.token);

        if (cors && !cookie.find('girderToken')) {
            // For cross-origin requests, we should write the token into
            // this document's cookie also.
            document.cookie = 'girderToken=' + getCurrentToken();
        }

        events.trigger('g:login.success', response.user);
        events.trigger('g:login', response);

        return response.user;
    }).fail(function (jqxhr) {
        events.trigger('g:login.error', jqxhr.status, jqxhr);
    });
}
Log in to the server. If successful, sets the value of currentUser
and currentToken and triggers the "g:login" and "g:login.success".
On failure, triggers the "g:login.error" event.

@param username The username or email to login as.
@param password The password to use.
@param cors If the girder server is on a different origin, set this
to "true" to save the auth cookie on the current domain. Alternatively,
you may set the global option "girder.corsAuth = true".
@param otpToken An optional one-time password to include with the login.