1763671 - Provide a mechanism to disable Basic HTTP Auth (Policy or otherwise)

Status: NEW

(Core :: Networking: HTTP, enhancement, P2)

Description

[Mike Kaply [:mkaply]]

Chrome and Edge have a policy to disable Basic HTTP Auth for security reasons:

https://docs.microsoft.com/en-us/deployedge/microsoft-edge-policies#basicauthoverhttpenabled

It would be nice if we provided something similar.

Comment 1

[Mike Kaply [:mkaply]]

I checked on Chrome and in the case where it's turned off, they just return a 401 not authorized (no UI).

They never even send the request, just return immediately.

Comment 2

[Mike Kaply [:mkaply]]

Easy place to test:

http://httpbin.org

Comment 3

[Valentin Gosu [:valentin] (he/him)]

I understand the requirement here is that we want to add a pref that disables Basic auth over unencrypted HTTP.
Seems easy enough. Let's try to do it.

Comment 4

[Sean Kim]

Can be tested with http://httpbin.org/bearer.

Comment 5

[Sean Kim]

Hello Valentin, do we need a separate error page for this patch?

Comment 6

[Valentin Gosu [:valentin] (he/him)]

No, I don't think we need a separate one. But I assume bug 1325876 will also cover this.

Comment 7

[Sean Kim]

We should complete the patch once bug 1325876 is landed.