1435085 - [meta] HTTP Auth security and UI fixes

Status: NEW

(Core :: DOM: Security, enhancement, P3)

Description

[Tanvi Vyas[:tanvi]]

There have been a number of HTTP Auth bugs recently.  Creating this meta bug to help layout what an HTTP Auth Fix Up project may include.

Comment 1

[Matthew N. [:MattN]]

See also the existing whiteboard tag… https://bugzil.la/sw:%22[passwords:http-auth]%22

Comment 2

[Tanvi Vyas[:tanvi]]

* Security bugs

* HTTP Auth should be tab modal instead of window modal to prevent annoyance (evil traps).

* HTTP Auth should be restricted for subresources as much as possible to prevent phishing.

* HTTP Auth should perhaps be disabled on HTTP pages.

* The HTTP Auth dialog needs to be modernized:
** modern UI
** if a subresource is requesting auth, it needs to be very clear that it is not the top level page
** if HTTP Auth is allowed on an HTTP page, we should show the lock with the strikethrough

Comment 3

[Matthew N. [:MattN]]

(In reply to Tanvi Vyas[:tanvi] from comment #2)
> * HTTP Auth should be restricted for subresources as much as possible to
> prevent phishing.

bug 647010

Comment 4

[Shane Caraveo (:mixedpuppy)]

Not so much a blocker on bug 1410548, but I want to track this so I can verify any change in behavior.

Comment 5

[brunoais]

> * HTTP Auth should perhaps be disabled on HTTP pages.

In many dev pages and localhost dev pages, it's a rarity to use HTTPS because the credentials are usually of low value and because it would require either to use and whitelist a self-signed certificate or pay more for the certificate to include the development domains. Even worse, the dev may not have the name registered in a DNS and be accessible by ip only.

Given that, it is OK to have HTTP Auth disabled for HTTP page by default but, if done so, I strongly believe that there should be an option for devs to enable HTTP Auth on non-secure connections

Comment 6

[doxypad]

?????