1210885 - HTTP 401 errors will trigger login prompts when inlined on third party websites

Status: UNCONFIRMED

(Core :: Networking: HTTP, defect, P3)

Description

[josh]

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2371.0 Safari/537.36

Steps to reproduce:

Using the <img /> tag to inline content from a website (even 3rd party remote websites) that are behind an HTTP Authentication screen will trigger a prompt asking for login credentials.

For instance, link this image on a forum.
http://filthyfigments.com/members/comics/onelatenight/0109.jpg


Actual results:

You will get this prompt.
http://i.imgur.com/WOgt5Ec.png

This scares the hell out of people.


Expected results:

I expected a broken image. When someone tried to link this image (which apparently belongs to a paid-user area of a porn site), dozens of people browsing the index page of my website who use Mozilla Firefox got a prompt asking them for their porn site credentials, which made them believe their browser or my website was compromised by a virus.

Nobody who was introduced to computers in the last decade has used an HTTP Authentication form. Nobody knows what they look like. This should be hidden unless you are accessing the document directly.

Comment 1

[Dragana Damjanovic [:dragana]]

if you go to about:config and then search for:
network.auth.subresource-http-auth-allow

and change it value to 1.
This will not allow an authentication dialog to prompt for cross-origin subresources. But we cannot put this as default because it breaks some sites and actually wonted behavior. 

see bug 647010.

Comment 2

[josh]

Well, that's just another reason to keep using Chrome I guess. I feel bad for people who trust FireFox at work and visit an unsuspecting website only to see "Enter in your fetishlord.xxx details!" throw up on the middle of the screen. Very few people use 401s in 2015, especially in this obscure and counter intuitive way. I think it's OK to tell the Internet to grow up sometimes.

Comment 3

[josh]

Proof of concept:
http://animalfetishporn.us/

I sincerely believe this will be abused and have done my part to make sure that happens.

Comment 4

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Comment 5

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258