219962 - .htaccess-protected site shows authentication sheet repeatedly

Status: RESOLVED DUPLICATE of bug 206351

(SeaMonkey :: UI Design, defect)

Description

[Ryan Schmidt]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/85 (KHTML, like Gecko) Safari/85
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.5b) Gecko/20030917 Camino/0.7+

I have an installation of phpMyAdmin that's protected with an .htaccess file, so that the visitor 
must enter a username and password before seeing the site. In IE 5.2.3 and Safari 1.0 all is well. In 
Camino, the authentication sheet is repeatedly displayed. I enter the correct username and 
password and click OK, the sheet goes away, and comes back. When I finally click Cancel a few 
times, the page loads -- but without CSS stylesheet and without images. It's as if it was asking me 
again for the credentials for each HTTP request it has to make to the server or something.

Reproducible: Always

Steps to Reproduce:
1. Install phpMyAdmin 2.5.3.
2. Protect this with standard Apache HTTP authentication by creating a .htaccess file which 
references an htpassword file.
3. Access the page using Camino and enter the correct credentials -- the sheet keeps reappearing.
4. Access the page with Safari or IE -- the sheet appears once, goes away, and shows you the stie
Actual Results:  
Sheet keeps reappearing after correct credentials have been entered.

Expected Results:  
Expected the sheet to show up once and then disappear after input of valid credentials.

Comment 1

[Ryan Schmidt]

I've just discovered that this bug also occurs in Mozilla Firebird 0.6.1 on Windows XP. Perhaps 
there is already a duplicate bug filed for Mozilla in general.

Comment 2

[Mike Pinkerton (not reading bugmail)]

browser

Comment 3

[Frankie]

This is similar to bug 206351 except that you say it still happens even after
providing a valid login. Could you provide a testcase URL?

Comment 4

[Ryan Schmidt]

Over fourteen months to respond to a bug report? This may be one of the reasons why I no longer use a 
Mozilla product as my primary browser.

The server on which I experienced the issue no longer exists and I obviously can't recall now exactly 
what I was doing to produce the error. But I believe there was probably a configuration error in our 
phpMyAdmin installation. You can specify in phpMyAdmin's configuration what its absolute URL is, and 
if you actually access it with a different URL (different hostname, say), then parts of the site come from 
one hostname and parts come from another. And the browser therefore presents two authentication 
dialogs.

There may have been a problem with older Camino / Firefox releases where this situation caused even 
more authentication boxes even after the correct login had been entered for both hostnames, but I 
cannot reproduce this in Firefox 1.0 or Camino 20050101, both on Mac OS X 10.3.7.

I do however have a test page for you. It's modeled after the way our phpMyAdmin installation would 
presumably have been set up. When you access the page, you're prompted for username and password. 
Both of these are the number "9". The main HTML is a frameset which loads three other frames on that 
same domain (so you're not asked to reauthenticate to load the frames). The frames themselves 
however have a base href tag pointing to a different password-protected domain (same username/
password), so for each of the images you're prompted again. To simulate a busy server or a slow 
connection or whatever, the server is programmed to wait 5 seconds before sending the HTML for each 
of the 3 frames. It's also programmed to send only one frame at a time. If you log in to the 
authentication dialog for the first (frameset) HTML file, but then try to cancel the authentication dialog 
that shows up when it tries to load the images, a behavior occurs which could be described as a bug:

1) An authentication dialog is shown individually for each image that's on that domain. A better 
behavior might be that the browser would conclude that cancelling the authentication for one object on 
a server should cancel all other requests on the same server. phpMyAdmin, in a default installation, 
probably has close to 20 external objects that would get loaded.

If you cancel the 2nd and 3rd authentication dialogs before the 5 seconds are up (that is, before the 
HTML for the next frame has arrived), then another annoyance occurs:

2) The browser asks again for authentication on the images that I've already told it before I don't know 
the passwords for. (Each of my three test frames loads the same images.) The browser could skip doing 
that, and not ask again until the user actually initiates another page load (as opposed to something like 
a frameset or an iframe initiating another page load, which to a user's mind is a different thing).

Interestingly, both of these behaviors also occur in Safari 1.2.4, Omniweb 5.0.1 and Opera for Mac 
7.54. Internet Explorer for Mac 5.2.3 only exhibits behavior 1).

Here is the test page URL:

http://test.michel-consulting.de/ryan/mozilla_frameset_password/

So, in the end, I suppose this bug should be closed, and work should continue on 206351.

Comment 5

[Frankie]

Thanks for the helpful reply.

*** This bug has been marked as a duplicate of 206351 ***