135875 - Browser locks up on XML Get if basic authentication not provided

Status: RESOLVED FIXED

(Core :: XML, defect)

Description

[David Barnes]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.9) Gecko/20020311
BuildID:    2002031104

When attempting to use XMLHTTPRequest Get on a page that requires basic
authentication, the browser will lock up if no username/password is provided.
Note: using a URI in the format of
http://username:password@localhost/secure.html works fine.

Reproducible: Always
Steps to Reproduce:
1. Do an HTTP Get on a page requiring basic authentication login
2. Browser then freezes and Mozilla must be shut down

Actual Results:  Browser freezes - nothing works. Have to kill the browser and
restart.

Expected Results:  Something other than freezing the browser.

In IE, a prompt for a username/password appears. If I hit cancel, it then
receives the html of the error page.

Comment 1

[David Barnes]

Attachment: Page I use to recreate problem

This page does an http get on a page which requires basic authentication. In
Mozilla, the whole browser freezes and must be restarted.

Comment 2

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Could you please provide a URL to a site that uses this?

Have you tested this if you do overrideMimeType("text/xml") before calling send()?

Darin, I think I would need help with this one.

Comment 3

[David Barnes]

Well, I've done it a number of times locally and it keeps happening. But when I
try sites on the Internet, it doesn't freeze. Let me keep checking around on
this, perhaps it's a false alarm.

Comment 4

[David Barnes]

OK, here's my home server running off a dsl line that should hopefully recreate
the problem:

http://algonquin.tzo.com/test.html

Try to to GET it with a username/password and it should freeze Mozilla. The
actual username and password are: 

username: test
password: test

Just trying to get the default page .... http://algonquin.tzo.com should work.

I'm on a 30-day trial with this tzo.com DNS thing, so I'm not sure how available
this site will be for testing.

I'm using Windows 2000 server, iis 5, with the .NET framework installed. I
configured password-protection using basic authentication via the IIS gui (not
the .net web.config file).

Let me know if you can recreate.

Comment 5

[David Barnes]

Sorry - meant to say try to get the test.html page "without" a username/password
and it will freeze Mozilla.

Comment 6

[David Barnes]

I could be way off here, but I used Netmon to trace what happens when requesting
the algonquin.tzo.com/test.html page and compared to trying to get this
password-protected page: http://www.cncdemo.com/CNC/index.cgi

I had to access both through a public proxy server, so that may have had an
effect on my results. Anyway, a difference was the TCP Push flag. On the page
that did not work, I had:

TCP: ....0... = No Push function

On the page that didn't freeze Mozilla, I had:

TCP: ....1... = Push function

It's confusing because these are the opposite results of what I found on Bug 129607

So maybe it is something completely different.

Comment 7

[Darin Fisher]

reporter: can you please try to reproduce this bug using a recent nightly build?
 i believe the bug you are seeing might be a duplicate of the recently fixed bug
132329.  thx!

Comment 8

[David Barnes]

I downloaded the nightly build - 2002040803 - and still have the problem. The
site I'm hitting is on the same machine that I run Mozilla on, but I don't know
if that makes a difference. Also, I still can't do HTTP Gets to
www.budweiser.com and a number of other sites, even though they don't have
password protection at all. I'll upload the test page I'm using - you'll just
need to load it into Mozilla and it will attempt to hit a passsword-protected
page on my home server. For me at least it causes Mozilla to lock-up.

Comment 9

[David Barnes]

Attachment: Page that requires username/password

This page tries to grab a page that requires a username/password, which are not
supplied. If you include the username and password (test/test), it works fine.
I tried several other password sites and did not have this problem.

Comment 10

[Darin Fisher]

what exactly do i need to do to reproduce the problem?  i tried simply loading
the page directly from the link you supplied and nothing bad happens.  tested
using optimized CVS build from yesterday under win2k.

are you perhaps connecting to the internet using a web proxy?

i also don't have any trouble loading www.budweiser.com.

Comment 11

[David Barnes]

Well that's really aggravating, I don't know what to say. Loading that page for
me causes Mozilla to lock up - same for regular web sites like yahoo.com,
budweiser.com and homedepot.com. But other sites like mozilla.org and apache.org
work fine. At the very least, it seemed like Heikki confirmed a problem getting
yahoo.com - take a look at Bug 129607 

I'm not using a proxy server, unless my dsl provider Southwestern Bell is doing
something I don't know about. I downloaded the installer from this page
http://ftp.mozilla.org/pub/mozilla/nightly/latest/ and am using W2K Server.

I'll keep checking to see if I am doing something wrong.

Comment 12

[David Barnes]

I tried opening the page by clicking on the link and nothing happened - same as
with you. However, if I did a "Save Link Target As" and downloaded to my
harddrive and then opened it, I had the problem. Once on the harddrive, you can
open the file in a test editor and change the page it is getting by altering
this line:

p.open("GET","http://algonquin.tzo.com/test.html");

I looked in my IIS log file for when I am trying to get the page. These two
lines show an unsuccessful attempt (using the above line) and a successful
attempt using the url of http://test:[e-mail]/test.html

2002-04-08 23:53:00 65.64.152.5 - 65.64.152.5 80 GET /test.html - 401 HTTP/1.1
algonquin.tzo.com
Mozilla/5.0+(Windows;+U;+Windows+NT+5.0;+en-US;+rv:0.9.9+)+Gecko/20020408 - -

2002-04-08 23:53:00 65.64.152.5 test 65.64.152.5 80 GET /test.html - 200
HTTP/1.1 algonquin.tzo.com
Mozilla/5.0+(Windows;+U;+Windows+NT+5.0;+en-US;+rv:0.9.9+)+Gecko/20020408 - -

See the error code 401 instead of 200? Perhaps the problem on happens when
loading the file from the hard drive?

Comment 13

[David Barnes]

The fixing of Bug 129607 seems to have taken care of this problem. I think the
issue was the same - my "unauthorized access" page had inline style elements
which caused the browser to freeze. Thanks for fixing this.

Comment 14

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Ok, marking fixed per user comments. Thanks.

Comment 15

[Rakesh Mishra]

Changing Q/A contact