1256160 - Treeherder tries to sign me into mozilla.com as a different user

Status: RESOLVED INCOMPLETE

(Tree Management :: Treeherder, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Attachment: screenshot login notice

I starred bugs on treeherder a few minutes ago with this open: https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&filter-resultStatus=testfailed&filter-resultStatus=busted&filter-resultStatus=exception&filter-resultStatus=retry&filter-resultStatus=usercancel&filter-resultStatus=runnable

Suddenly, a prompt popped up that I am currently trying to log me into mozilla.com with the user name "bbirtles". It's SuperfluousAuth string from necko (screenshot is in German). This is the English string:
	
> You are about to log in to the site "%1$S" with the username "%2$S", but the website does not require authentication. This may be an attempt to trick you.\n\nIs "%1$S" the site you want to visit?

I didn't open any new tabs and had starred some of the jobs of a push by bbirtles https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=7a82b7529ca5 but had already moved on to the parent push by Gijs and starred a failure for that, so there was some delay if it had been caused by the starring of one of these jobs by bbirtles.

Restricted as security bug as precautionary measure.

Browser is Firefox 45.0, operating system Windows 8.1

Comment 1

[Adam Muntner [:adamm] (use NEEDINFO)]

Thanks for reporting Sebastian.

There is a badly formed link somewhere, where the website put an email address into a link tag. 

If you visit http://[e-mail] the browser as will show the dialog you saw. This is part of a supported HTTP standard - you might have seen before something like http://user:[e-mail] which would pass http basic auth credentials with the URL. 

I'm keeping the bug open but removing the security flag.

Thanks for your report!

Comment 2

[Ed Morley [:emorley]]

Thank you for the explanation Adam - that's helpful :-)

I've looked at both the source and the links in comment 0 and I'm struggling to find such a broken link, which is strange...