OpenSearch doesn't work with authenticated sites
Categories
(Firefox :: Search, defect)
Tracking
()
People
(Reporter: alexandermomchilov, Unassigned)
Details
User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Steps to reproduce:
- Visited an internal company site that requires authentication that has an OpenSearch manifest
- From the URL bar, click to add the site as a search engine.
Actual results:
An error dialogue box shows up with "Firefox could not install the search engine from: https://the.internal.site.com/opensearch.xml"
Expected results:
Access the opensearch.xml file with the same authentication request headers as the rest of the site, so that the file can be read and used to define the search engine.
|
||
Comment 1•4 years ago
|
||
The Bugbug bot thinks this bug should belong to the 'Firefox::Address Bar' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.
We worked around this by making our /opensearch.xml route not be hidden behind authentication.
This was acceptable for the base search functionality, but this is obviously wouldn't be appropriate for the search auto-completions endpoint, which would be leaking internal data.
|
||
Comment 3•4 years ago
|
||
Not sure what opensearch should be doing in this particular scenario, most likely :standard8 has a better understanding of this than I.
|
||
Comment 4•4 years ago
|
||
Dupe of existing bug 1624457.
Description
•