1601375 - Firefox asks for master password when it shouldn't (credentials stored for unrelated subdomain)

Status: NEW

(Toolkit :: Password Manager, defect, P3)

Description

[Johannes]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0

Steps to reproduce:

I have previously stored a HTTP basic auth password for one site, let's call it sub1.example.org, in the Firefox password safe, which is protected with a master password.

After upgrading from Firefox 70 to 71, I am now prompted to enter my master password for a HTTP POST-based login form on site sub2.example.org, which has nothing to do with the basic auth login on the other subdomain. I control both subdomains so I know that their code hasn't changed (i.e. there is certainly no sub1.example.org frame embedded into sub2.example.org or similar).

If I do enter the master password, Firefox doesn't fill in any credentials on sub2.example.org, which is expected because the basic auth credentials from sub1.example.org do of course not match the HTTP POST input fields on sub2.example.org

Actual results:

I am asked to enter my master password although there are only passwords stored for an unrelated, different subdomain.

Expected results:

No password prompt, like in Firefox 70 and earlier.

Comment 1

[Matthew N. [:MattN]]

Good find. I think the problem is that we request logins from storage with subdomains and then filter out the inexact matches which is wrong in this case.

Comment 2

[Timea Cernea [:tbabos][inactive]]

Reproduced on Windows 10 x64, Latest Nightly, Beta and Release. Unfortunately, we didn't have a test for this scenario, added it now.

Comment 3

[Liz Henry (:lizzard) (relman/hg->git project)]

Too late for a fix in 72 at this point, but we could still take a patch for 74.

Comment 4

[Jens Stutte [:jstutte]]

:mattn, can you or someone in your team spend some cycles on this (tracked as carry-over regression for 74)?

Comment 5

[Matthew N. [:MattN]]

It's not a priority unfortunately since it affects less than 1% of the userbase. We're tracking it as a P2 so will re-evaluate relative to other priorities eventually.

Comment 6

[Sergey Galich [:serg]]

Moving to P3 as this is not happening in the next release cycle.