1423146 - Do not allow an auth prompt requested by an image resource loaded from cross-origin

Status: RESOLVED FIXED

(Core :: Networking: HTTP, enhancement, P3)

Description

[Dragana Damjanovic [:dragana]]

We only need to change  pref.

Comment 1

[Dragana Damjanovic [:dragana]]

Chrome already have this as default(bug 647010 comment 87) so I do not expect that we will break something.

Comment 2

[Dragana Damjanovic [:dragana]]

Attachment: bug_1423146.patch

Comment 3

[Dragana Damjanovic [:dragana]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=4a10f8ec00782460b6a28a57dba36bae1ccca96a

Comment 4

[Christoph Kerschbaumer [:ckerschb]]

Do we need an intent-to-ship for this?

Comment 5

[Dragana Damjanovic [:dragana]]

(In reply to Christoph Kerschbaumer [:ckerschb] from comment #4)
> Do we need an intent-to-ship for this?

I will write one, although Chrome already implement this.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1a59ea77d44f
Change a pref so that an auth prompt requested by an image resource loaded from cross-originis not allowed. r=ckerschb

Comment 7

[Kohei Yoshino [:kohei]]

Posted the site compatibility note: https://www.fxsitecompat.com/en-CA/docs/2017/http-auth-dialog-can-no-longer-be-triggered-by-cross-origin-images/

Comment 8

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/1a59ea77d44f

Comment 9

[Chris Mills [:cmills]]

I've documented this on MDN:

* Added a note to the Fx59 rel notes:
https://developer.mozilla.org/en-US/Firefox/Releases/59#Security

* Added a small section to the HTTP authentication page:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#Authentication_of_cross-origin_images

Let me know if this is OK. Thanks!

Comment 10

[Dragana Damjanovic [:dragana]]

(In reply to Chris Mills (Mozilla, MDN editor) [:cmills] from comment #9)
> I've documented this on MDN:
> 
> * Added a note to the Fx59 rel notes:
> https://developer.mozilla.org/en-US/Firefox/Releases/59#Security
> 
> * Added a small section to the HTTP authentication page:
> https://developer.mozilla.org/en-US/docs/Web/HTTP/
> Authentication#Authentication_of_cross-origin_images
> 
> Let me know if this is OK. Thanks!

Looks good. Thanks.

Comment 11

[MustLive]

Hello!

This bug is just the same as my Bug 647010, which I informed Mozilla about in March 2011. This is vulnerability in all browsers, which support Basic/Digest Authentication, as I wrote in my entry. So a lot of web browsers are vulnerable, not only Firefox.

I called this attack as Onsite phishing (or Inline phishing). It can be used (including by phishers) for stealing of logins and passwords of users of web sites.