1538737 - Firefox asks for proxy password when typing into the address bar

Status: VERIFIED FIXED

(Core :: Networking, defect)

Description

[SanskritFritz+github]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0

Steps to reproduce:

We're using Microsoft EMG proxy with NTLM authentication at our workplace.
The proxy settings in Firefox:

Manual proxy configuration / HTTP proxy: proxyurl.biz Port: 8080
☑ Use this proxy server for all protocols
No proxy for: localhost, 127.0.0.1
☑ Do not prompt for authentication if password is saved

When I start Firefox it asks for the proxy username/password once and I can use the browser without problems.
However when I start to type into the address bar, Firefox pops up the same user/password dialog after every typed character.

This bug appeared first in Firefox version 65, downgrading to version 64 solved the problem. Now we're at version 66, the problem is still present. Downgrading is not possible anymore due to library dependecies, so I switched to cntlm, this way Firefox doesn't have to ask for a password.

Tested on Arch Linux, Fedora, Debian Jessie.

Comment 1

[SanskritFritz+github]

I was asked to write a new bug report here: https://bugzilla.mozilla.org/show_bug.cgi?id=1520125

Comment 2

[Honza Bambas (:mayhemer)]

Thanks for filing this. I will ask you to provide a log then as described at [1]. URLs, proxy settings and cookies will be visible, so feel free to send it to my bugzilla email directly.

[1] https://developer.mozilla.org/en-US/docs/Mozilla/Debugging/HTTP_logging#Start_logging_using_command_line_arguments

Comment 3

[SanskritFritz+github]

Attachment: mozilla_log_20190326.7z

frank@FrankVM ~> firefox --profilemanager -MOZ_LOG=timestamp,rotate:200,nsHttp:5,cache2:5,nsSocketTransport:5,nsHostResolver:5 -MOZ_LOG_FILE=/home/frank/temp/mozilla_log_20190326.txt

Comment 4

[SanskritFritz+github]

I attached the log files.
I started a new profile, saved the proxy password at start and typed "hello" into the address bar, while the password dialog appeared after every keypress (except the first "h", probably because Firefox doesn't start a search on only one letter).

Comment 5

[Honza Bambas (:mayhemer)]

Thanks. I believe I know what's going on here. The patch in bug 1520125 is rather incomplete. It ignores the OA isolation suffix only for one of possible code paths to obtain cached credentials. There are more places we need to ignore the suffix for proxy as well. Specifically for all call sites of [1] and for this particular case at [2].

P1 to definitely fix this in this cycle as 68 is the next esr.

[1] https://searchfox.org/mozilla-central/rev/2c912888e3b7ae4baf161d98d7a01434f31830aa/netwerk/protocol/http/nsHttpAuthCache.h#167,176
[2] https://searchfox.org/mozilla-central/rev/2c912888e3b7ae4baf161d98d7a01434f31830aa/netwerk/protocol/http/nsHttpChannelAuthProvider.cpp#695

Comment 6

[SanskritFritz+github]

I'm glad I could help and thanks for doing this.

Comment 7

[Honza Bambas (:mayhemer)]

Attachment: Bug 1538737 - Don't isolate proxy auth credential cache by origin attributes on all places, r=valentin

Comment 8

[Honza Bambas (:mayhemer)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=0e1e79145f55d715e92d37b9c2f06f306222ff3b

Comment 9

[Honza Bambas (:mayhemer)]

I decided not to write a test for this, because the proxy involved here is ntlm (for which we don't store proxy-authorization request headers, the bit that bug 1520125 has fixed).

creating that test falls into the ntlm-automated-tests bucket, a road I don't want to go now.

Comment 10

[SanskritFritz+github]

If I can help with testing somehow, just call me.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/77fe863f36eb
Don't isolate proxy auth credential cache by origin attributes on all places, r=valentin

Comment 12

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/77fe863f36eb

Comment 13

[Honza Bambas (:mayhemer)]

SanskritFritz, if you can, please install the latest Nightly [1] and test with it. It will create a separate profile, so you will have to set the proxy in Firefox Nightly preferences again.

Thanks!

[1] https://www.mozilla.org/en-US/firefox/nightly/all/

Comment 14

[SanskritFritz+github]

:mayhemer
I have downloaded the Linux 64 nightly build and ran it.
I can confirm that the bug has been fixed there.

Comment 15

[Honza Bambas (:mayhemer)]

Just to confirm - you mean Linux x64 (64-bit) build, right?

Thanks! Marking as verified.

Comment 16

[SanskritFritz+github]

Yes, exactly :D

Comment 17

[Pascal Chevrel:pascalc]

Honza, do you think that your patch would be safe to uplift to 67 beta? Thanks

Comment 18

[Honza Bambas (:mayhemer)]

(In reply to Pascal Chevrel:pascalc from comment #17)

Honza, do you think that your patch would be safe to uplift to 67 beta? Thanks

possibly.

Comment 19

[Pascal Chevrel:pascalc]

(In reply to Honza Bambas (:mayhemer) from comment #18)

(In reply to Pascal Chevrel:pascalc from comment #17)

Honza, do you think that your patch would be safe to uplift to 67 beta? Thanks

possibly.

Could you make an uplift request then? Thanks

Comment 20

[Honza Bambas (:mayhemer)]

Attachment: Beta patch

Beta/Release Uplift Approval Request

• Feature/Bug causing the regression: https://bugzilla.mozilla.org/show_bug.cgi?id=1520125#c16
• User impact if declined: default credentials for ntlm proxies are not used when typing to an address bar, this is unexpected and highly annoying.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: I think comment 0 may be a good STR source, but this is somewhat hard to setup
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): this only removes isolation of session-cached proxy credentials by OA, I don't expect anything to break with this change, it's relatively isolated
• String changes made/needed: -

Comment 21

[Camelia Badau [:cbadau], Release Desktop QA]

(In reply to SanskritFritz+github from comment #14)

:mayhemer
I have downloaded the Linux 64 nightly build and ran it.
I can confirm that the bug has been fixed there.

Could you please verify this when the fix will land in Firefox 67? I will provide you the URL's build when it's ready.

Comment 22

[Pascal Chevrel:pascalc]

Comment on attachment 9056648 [details] [diff] [review]
Beta patch

Low risk patch for a recent regression, approved for 67 beta 10, thanks.

Comment 23

[SanskritFritz+github]

(In reply to Camelia Badau [:cbadau], Release Desktop QA from comment #21)

(In reply to SanskritFritz+github from comment #14)

:mayhemer
I have downloaded the Linux 64 nightly build and ran it.
I can confirm that the bug has been fixed there.

Could you please verify this when the fix will land in Firefox 67? I will provide you the URL's build when it's ready.

Yes, sure, I will test it then.

Comment 24

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/releases/mozilla-beta/rev/25c22c51d9ce

Comment 25

[Honza Bambas (:mayhemer)]

Pascal, the correct regressing bug is bug 1510281.

Comment 26

[Arthur K.]

Hi. Please see bug 1548804 as this may have regressed something.