1316284 - [enhancement] Ask user if they wants to send SSO credentials to the server which requests them

Status: NEW

(Core :: Networking: HTTP, enhancement, P5)

Description

[Jan Horak [:jhorak]]

Currently the user is never asked whenever they wants to send credentials when WWW-Authenticate: Negotiate header appears.

Imagine scenario when Firefox is configured as every https:// page is trusted to be send credentials to. There's reasoning to do so, because SSO is believed to be much safer that using username/password. If that's the case, having mechanism to ask user if they really want to send credentials to the specific page is useful.

It could be implemented as another site permission.

Comment 1

[Jan Horak [:jhorak]]

Attachment: screencast demo.mkv

Attached screencast of the feature, please have a look if that's viable.

Comment 2

[Honza Bambas (:mayhemer)]

This sounds like a good idea to me.

Comment 3

[Blake Winton (:bwinton) (:☕️)]

Comment on attachment 8808974 [details]
screencast demo.mkv

(The ux-review alias doesn't really go to anyone, and frequently gets lost.  If you actually want a ui-review, you probably shouldn't use it.  Redirecting to Philipp, who will probably redirect it to someone more appropriate.)

Comment 4

[(Currently slow to respond) Philipp Sackl [:phlsa] (Firefox UX) please use needinfo]

Comment on attachment 8808974 [details]
screencast demo.mkv

Hey there, sorry for the long delay.
I can only comment on the UI here, not on the potential security implications (NI Tanvi for that).

The UI is sound in itself, but also looks quite intrusive to me (popping up on page load and blocking the entire browser). Can we estimate how often this would happen for any given user? What are the circumstances under which a user would see this prompt.

On a more superficial level: is there a reason that this uses different UI than the other permission prompts?

Comment 5

[Jan Horak [:jhorak]]

(In reply to (Currently slow to respond) Philipp Sackl [:phlsa] (Firefox UX) please use needinfo from comment #4)
> Comment on attachment 8808974 [details]
> screencast demo.mkv
> 
> Hey there, sorry for the long delay.
> I can only comment on the UI here, not on the potential security
> implications (NI Tanvi for that).
> 
> The UI is sound in itself, but also looks quite intrusive to me (popping up
> on page load and blocking the entire browser). Can we estimate how often
> this would happen for any given user? What are the circumstances under which
> a user would see this prompt.
User would see the prompt when the page sends www-Authenticate: Negotiate header for the first time he hit the page. Any subsequent communication with GSSAPI is determined by user choose to the dialog. If the permission is set to remember, then the user is never asked again for particular website unless they change the permission to always ask.

> On a more superficial level: is there a reason that this uses different UI
> than the other permission prompts?
I'd love to use permission prompts, but currently is not possible, because page has not yet been loaded so it mInnerWindowID is not initialized which is required by current permissions implementation to show permission popup. Maybe someone could help me with that to fix it. I've discussed it with Christoph Kerschbaumer and we didn't find any way so far.

Comment 6

[Julien Cristau [:jcristau]]

Mass wontfix for bugs affecting firefox 52.

Comment 7

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Comment 8

[Tanvi Vyas[:tanvi]]

JC, can you take a look at this?

Comment 9

[J.C. Jones [:jcj] (he/they)]

I wonder if using Containers / Contextual Identity is the more right move here than a UI change.

Most of the time Enterprise users do want to have their SSO credentials follow them around. Perhaps we could do something where containers don't provide them, or expose a WebExtensions flag to turn them on/off so that the Containers addon could impose its own toggle on a per-container basis.

It's such a corner case though - and one that I could see administrators wanting to disable - that I don't think I agree we should do UX like that proposed here. For most users I think it'd just be confusing.

Tying it into something like containers would let people who want to have more control get it, though.