1716782 - htaccess AuthName ist not shown in 89.x

Status: RESOLVED INVALID

(Toolkit :: Password Manager, enhancement)

Description

[git]

Attachment: FIrefox_Login.png

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0

Steps to reproduce:

go to any page that is protected with .htaccess
AuthType Basic
and an existing AuthName

Actual results:

AuthName "please enter Password for ..."
is not shown since version 89

Expected results:

As it is possible to have multiple different htaccess on the same server,
it would be very helpful to see this message and not only the domain name.
Like seen in the attachment there is only the information about domain.

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::Networking' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Kershaw Chang [:kershaw]]

Hi Reporter,

Could you try to use mozregression to find out where the problem is?

Thanks.

Comment 3

[git]

Hi,

virustotal says:
"16 security vendors flagged this file as malicious"

49055df28f02d8f9383383ffac83063db3c8ce337cb333a63dbf78b116ff71ac
mozregression-gui.exe

https://www.virustotal.com/gui/file/49055df28f02d8f9383383ffac83063db3c8ce337cb333a63dbf78b116ff71ac/detection

So sorry, i will definitely not use mozregression.

Comment 4

[Kershaw Chang [:kershaw]]

According to https://mozilla.github.io/mozregression/install.html, it should be safe to install mozregression-gui.exe, but it's up to you of course.

I think this could be related to the authentication prompt, but I am not sure which component is right. I'll try Firefox:General first. Please correct me if I am wrong. Thanks.

Comment 5

[Andrei Purice]

Setting a component for this enhancement in order to get the dev team involved.
If you feel it's an incorrect one please feel free to change it to a more appropriate one.

Comment 6

[Sam Foster [:sfoster] (he/him)]

The reasoning for the changes to how the HTTP auth challenge is presented is outlined here: https://bugzilla.mozilla.org/show_bug.cgi?id=1694418#c22

I'm going to mark this bug as invalid as this is intentional. If you have more information or want to present examples where this is a risk for users, please re-open it.

Comment 7

[git]

OK, you are right: this is no risk for users, but it is uncomfortable for me and maybe other users.

Some of the arguments in https://bugzilla.mozilla.org/show_bug.cgi?id=1694418#c22 should not really be treated as arguments.
this is no critisism, but more philosophy:
"other browsers do not display it" -> Why than have an own browser if i would do everything like others?

I would understand if the behaviour could be configured in about:config.
In security* there are hundreds of security settings like
security.tls.version.enable-deprecated
which might be even more security relevant.

nevertheless thanx to everybody who spent time with answering the request.