1592022 - Credentials of other sub domain sites are shown in the parent domain

Status: RESOLVED INVALID

(Toolkit :: Password Manager, defect)

Description

[CAPital Z]

Attachment: firefox-showing-all-logins.png

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0

Steps to reproduce:

Trying to login to my intended site

Actual results:

It shows all the possible logins when I click on the Login field.
It shows first the credentials for the exact domain. After that, it shows all credentials for all subdomain of that site.

Expected results:

Firefox should only show credentials of the exact site, and not all of it's subdomains.

I use Firefox 71.0b4 (64-bit) on Windows 10 (Version 10.0.17763 Build 17763)

Comment 1

[:Gijs (he/him)]

Removing security flags - it's not a security issue that's exploitable by third parties.

Comment 2

[Sam Foster [:sfoster] (he/him)]

(In reply to CAPital Z from comment #0)

Expected results:

Firefox should only show credentials of the exact site, and not all of it's subdomains.

This is by design; in 71 we have set signon.includeOtherSubdomainsInLookup to default to true. See bug 589628 for the motivations for this feature.