261044 - NTLM Auth with bad password floods network

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect)

Description

[Rich Loose]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20040913 Firefox/0.10
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20040913 Firefox/0.10

I am hitting a protected page on a Windows 2003 box running IIS.

The server responds with 401 auth required, with WWW-Negotiate headers
indicating a willingness to do Negotiate, NTLM, and basic auth.

Browser prompts for user/password.  Supply a bad password, or an account that
doesn't exist, or an account that is locked.

Browser sends the NTLM Neg request.

Server sends back the NTLM challenge.

Browser sends the NTLM Auth request.

Server sends back Auth-required as before.

So far so good, but then the browser (without prompting for another
user/password) initiates the authentication dance all over again with the same
credentails, stubbornly flooding the network with the same authentication sequence.

Although reported on the Windows browser, the Linux browser has the same
problem: Mozilla/5.0 (X11; U; Linux i686; rv:1.7.3) Gecko/20040914 Firefox/0.10

I am not using any password management, and have Ethereal traces if anyone is
interested.

Reproducible: Always
Steps to Reproduce:

Comment 1

[Daniel Veditz [:dveditz]]

Auth --> Darin

Comment 2

[Darin Fisher]

I wonder if my patch for bug 256949 will help this problem.

Rich: If you are willing to send me those ethereal traces I'd appreciate it, thx!

Comment 3

[Darin Fisher]

A Mozilla HTTP log would be nice too.  Instructions here:

  http://www.mozilla.org/projects/netlib/http/http-debugging.html

Thanks!

Comment 4

[Rich Loose]

Attachment: Ethereal trace of the problem

Darin, here's an Ethereal trace of the problem.  - Rich

Comment 5

[Darin Fisher]

Rich: Thanks! Can you please supply the Mozilla HTTP log as well. See comment #3.

Comment 6

[Darin Fisher]

my latest patch for bug 256949 fixes this bug.

Comment 7

[Darin Fisher]

marking FIXED, now that my patch for bug 256949 went in on the trunk, 1.7
branch, and aviary-1.0 branch.

Comment 8

[Darin Fisher]

*** Bug 259854 has been marked as a duplicate of this bug. ***

Comment 9

[Darin Fisher]

*** Bug 259344 has been marked as a duplicate of this bug. ***

Comment 10

[Darin Fisher]

*** Bug 265609 has been marked as a duplicate of this bug. ***