Per discussion in triage, we think that all reasonable fixes here are in platform code, one or more of: - unload the original page before triggering http auth (e.g. the about:blank suggestion in comment 9) - break the xhr callbacks running in this situation so no JS can run - abort download requests triggered by the page before it navigated away (though that likely has other repercussions) - disable http auth by default
Bug 1944926 Comment 10 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Per discussion in triage, we think that all reasonable fixes here are in platform code, one or more of: - unload the original page before triggering http auth (e.g. the 401 rendering or the about:blank suggestion in comment 9 - from a security pov either would work) - break the xhr callbacks running in this situation so no JS can run - abort download requests triggered by the page before it navigated away (though that likely has other repercussions) - disable http auth by default The frontend was updated to show the http auth origin, but it cannot show both that and the page origin so there is no way to put more lipstick on this particular pig.