1446265 - (proxy-save-password) No way to save proxy password when requested during early startup before a window exists

Status: NEW

(Toolkit :: Password Manager, defect, P3)

Description

[cnd]

Attachment: pic 2018-03-16 16.00.14_02.png

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
Build ID: 20180310025718

Steps to reproduce:

Activate a proxy.
Check the box "Do not prompt for authentication is password is saved" option.
Browse any site.
Proxy password dialogue appears, with no option to save the password.


Actual results:

See screenshot.


Expected results:

Dialog box needs a "save password" checkbox included in it

Comment 1

[Ciprian Muresan [:cmuresan], Formerly of Ecosystem QA - please needinfo @mcoman for things regarding the team]

@cnd,

Could you please post more explicit steps in order to reproduce this issue? I've added https proxy and it didn't prompt me to add a username or password.

Also what happens after you log it? I believe a password doorhanger should appear prompting you save the username and password.

Comment 2

[cnd]

It happens every time for me - if you're not being asked, it's because you already saved the password beforehand I expect (or are using a proxy with no password).

Either use a new proxy on a new address with a new account for which you've never used the password before, or
Get rid of all your saved passwords [or at least the one for the proxy]
*. be sure the proxy you're using needs a password (proxy-authenticate header I think?)

Nothing else pops up after the proxy dialogue.

Not relevant (I think) but my homepage is set to "About:blank" so when I open the browser, it never loads anything by default (the browser itself *does* make connections to something - probably updates-checking I guess) - so - every time I open my browser, I get the proxy login dialogue box, and after I enter my username/password, I see my blank start screen only.

Comment 3

[cnd]

p.s. I would guess that this is a simple case of searching through the source code for where it pops up that dialog box?  Asking for passwords through a dialog that has no "remember" control on the dialogue seems like an easy thing to find and fix?

Comment 4

[Ciprian Muresan [:cmuresan], Formerly of Ecosystem QA - please needinfo @mcoman for things regarding the team]

Hi cnd,

I've found no easy way to set-up a proxy that requires a password so we will have to this the hard way :) .

Has this issue always been this way or has it appeared recently? Could you please check and see if it is also reproducible on the latest Nightly build (https://nightly.mozilla.org)? 
Also, could you please check if the same behavior occurs when using a clean new profile (https://goo.gl/AWo6h8) to eliminate custom settings as a possible cause?

Comment 5

[cnd]

This issue has existed, as far as I know, forever.
In older firefox versions, there were plugins/addons for other people like me who were frustrated with this irritating behaviour.
I will email you my proxy - it's just a regular squid setup.

Comment 6

[cnd]

p.s. Did you take a look through the source?  The phrase "The site says:" in the dialogue should make it fast to find where the bug is - and if the popup has no method for saving passwords, that's the bug right there.

Comment 7

[Matthew N. [:MattN]]

Hello cnd,

The checkbox to save the password isn't supposed to appear in that dialog, it should only appear in a doorhanger anchored near the site identity block (lock icon on HTTPS) if the login was successful. Check for a key icon there… perhaps you see it appearing then disappearing.

Note that the prompt to save may not be shown if you're in a private browsing window.

Could you give more details about your proxy settings so I can diagnose better? Which type of proxy are you using e.g. HTTP, SOCKS, PAC, etc.

Debug logging (https://wiki.mozilla.org/Firefox:Password_Manager_Debugging) may also help to figure out why you're not seeing the doorhanger upon successful login.

Thanks

Comment 8

[cnd]

I respectfully disagree.  If an option to save a password exists, it *belongs* in the password dialog, not buried in some obscure ephemeral artifact in an unrelated later place.

Private browsing should not rob the user of having this option either - this is a PROXY we're talking about.  If they don't want to save it, they don't check the box.

> p.s. Did you take a look through the source?  The phrase "The site says:" in the dialogue should make it fast to find where the bug is - and if the popup has no method for saving passwords, that's the bug right there.

Comment 9

[Matthew N. [:MattN]]

(In reply to cnd from comment #8)
> I respectfully disagree.  If an option to save a password exists, it
> *belongs* in the password dialog, not buried in some obscure ephemeral
> artifact in an unrelated later place.

The reason it's not shown in the dialog (which is also used for HTTP auth) in general is because it's better to ask to save upon successful login rather than saving a login which ends up being incorrect. The other issue is that the checkbox gets confusing if we do have a saved login and therefore autofill it if autologin is off but then the user unchecks the checkbox and clicks ok. Does that mean we should delete the saved login? It's unclear.

Are you able to confirm that the doorhanger appears if you're not in a private window?

> Private browsing should not rob the user of having this option either - this
> is a PROXY we're talking about.  If they don't want to save it, they don't
> check the box.

I think that may make sense for proxy logins, at least as a dismissed-by-default doorhanger initially. We can have this bug focus on this issue if you want as I don't think we're likely to change the first issue. If you would like to fix this I can mentor you.

I think we would want to add a new argument to _showLoginCaptureDoorhanger to indicating that it should be dismissed by default. That would be used to set `dismissed:true` for the doorhanger .show() call and probably also to disable the visibilityToggle.

> > p.s. Did you take a look through the source?  The phrase "The site says:" in the dialogue should make it fast to find where the bug is - and if the popup has no method for saving passwords, that's the bug right there.

Not sure why you're repeating this… I read the source in order to reply in comment 7. Here it is if you want to read it: https://dxr.mozilla.org/mozilla-central/rev/0528a414c2a86dad0623779abde5301d37337934/toolkit/components/passwordmgr/nsLoginManagerPrompter.js#580-582,584-587

Comment 10

[cnd]

Your replies make no sense.

>  The other issue is that the checkbox gets confusing if we do have a saved login and therefore autofill it if autologin is off

This is NOT A WEB DIALOGUE - this is the PROXY LOGIN.  When the password is saved, the dialogue NEVER SHOWS UP.

> Are you able to confirm that the doorhanger appears if you're not in a private window?

This is nothing to do with private windows.  It has nothing to do with any kind of windows AT ALL.  When you first open firefox, it makes a network connection even before any windows are shown (update checking I guess) - so this proxy-password box with no way to save the wretched password is the first thing that pops up.

> in general is because it's better to ask to save upon successful login rather than saving a login which ends up being incorrect.

This comment is meaningless (the checkbox doesn't literally save it).  The checkbox exists to gather from the user the intent to save the password upon (later) success.  Because this is a PROXY, there is no easy or meaningful way to later on pester them with a second option to save the password at a later time, but even if there was, that is an inappropriate user experience.  Making them do extra work in the future after they've already dismissed that dialogue is a very poor user experience and design decision.  The point where people want to save their password is the point where they type it in.  Visit any website that lets you save your login - is the "save" checkbox on the same page as the login?  YES it always is.

Assuming the source dialog control has a hidden checkbox feature - that's the bug: Someone somewhere made the decision to hide this checkbox (probably because they did not realize that this dialog is used for proxy auth as well as whatever-else it's used for); find and remove that switch so the save option shows up.

Comment 11

[Matthew N. [:MattN]]

(In reply to cnd from comment #10)
> Your replies make no sense.
> 
> >  The other issue is that the checkbox gets confusing if we do have a saved login and therefore autofill it if autologin is off
> 
> This is NOT A WEB DIALOGUE - this is the PROXY LOGIN.  When the password is
> saved, the dialogue NEVER SHOWS UP.

You must be forgetting about the fact that proxy autologin is off by default so that's not always true AFAIK. See the checkbox in the proxy settings dialog: "Do not prompt for authentication if password is saved".

> > Are you able to confirm that the doorhanger appears if you're not in a private window?
> 
> This is nothing to do with private windows.  It has nothing to do with any
> kind of windows AT ALL.  When you first open firefox, it makes a network
> connection even before any windows are shown (update checking I guess) - so
> this proxy-password box with no way to save the wretched password is the
> first thing that pops up.

OK, that may be true in some cases but I guess the user can repeatedly cancel the login until the first window appears? All I know is that the code I linked to doesn't show the doorhanger if you're in a private window (or no window was specified) and I wanted to make sure that the logic works in a non-private window to ensure that there aren't multiple confounding problems.

> > in general is because it's better to ask to save upon successful login rather than saving a login which ends up being incorrect.
> 
> This comment is meaningless (the checkbox doesn't literally save it).  The
> checkbox exists to gather from the user the intent to save the password upon
> (later) success.  Because this is a PROXY, there is no easy or meaningful
> way to later on pester them with a second option to save the password at a
> later time, but even if there was, that is an inappropriate user experience.

I see what you're saying that there isn't necessarily a relevant tab to attach the doorhanger prompt to e.g. no window yet, or the request is from a request that Firefox makes, such as update checks.

> Assuming the source dialog control has a hidden checkbox feature - that's
> the bug: Someone somewhere made the decision to hide this checkbox (probably
> because they did not realize that this dialog is used for proxy auth as well
> as whatever-else it's used for); find and remove that switch so the save
> option shows up.

I guess that means you aren't planning to work on the fix?

Comment 12

[Justin Dolske [:Dolske]]

(In reply to cnd from comment #10)
> Your replies make no sense.
...
> This is NOT A WEB DIALOGUE - this is the PROXY LOGIN.  When the password is
> saved, the dialogue NEVER SHOWS UP.
...
> This is nothing to do with private windows.  It has nothing to do with any
> kind of windows AT ALL.
...
> This comment is meaningless

Hey, let's keep the comments civil and respectful. The people in this bug are trying to understand your issue and help. Your comments come across as brash and argumentative. Being more constructive is more likely  to help get to a fruitful conclusion (and, conversely, not doing so is more likely to result in your account being suspended.)

Comment 15

[Matthew N. [:MattN]]

Mike, is this something you've heard complaints about?

Comment 16

[Mike Kaply [:mkaply]]

I've never heard a complaint about this.

We have a preference in network settings for this:

Do not prompt for authentication if password is saved

Which seems to imply that there is a way to save the proxy authentication prompt.

Comment 17

[Matthew N. [:MattN]]

Yeah, I know that, it was mentioned earlier. This bug is about not being able to saved when the prompt happens during startup before a window appears.

Comment 20

[BugBot [:suhaib / :marco]]

The severity field for this bug is relatively low, S3. However, the bug has 3 duplicates.
:serg, could you consider increasing the bug severity?

For more information, please visit auto_nag documentation.

Comment 21

[BugBot (nomail) [:suhaib / :marco/ :calixte]]

The last needinfo from me was triggered in error by recent activity on the bug. I'm clearing the needinfo since this is a very old bug and I don't know if it's still relevant.