Closed Bug 1763671 Opened 4 years ago Closed 1 year ago

Provide a mechanism to disable Basic HTTP Auth

Categories

(Core :: Networking: HTTP, enhancement, P2)

Product:
Core
Component:
Networking: HTTP
Type:
enhancement
Points:
1

Tracking

()

Status:
RESOLVED FIXED
Milestone:
136 Branch
Tracking Flags:
Tracking Status
firefox136 --- fixed

People

(Reporter: mkaply, Assigned: sekim)

References

(Blocks 1 open bug)

Details

(Keywords: parity-edge, Whiteboard: [necko-triaged][necko-priority-queue])

Attachments

(2 files, 2 obsolete files)

Bug 1763671 - Part 1: Add a preference to disable basic HTTP Auth r=#necko,mkaply
48 bytes, text/x-phabricator-request
Details | Review
Bug 1763671 - Part 2: Add a test for a preference to disable basic HTTP Auth r=#necko
48 bytes, text/x-phabricator-request
Details | Review

Chrome and Edge have a policy to disable Basic HTTP Auth for security reasons:

https://docs.microsoft.com/en-us/deployedge/microsoft-edge-policies#basicauthoverhttpenabled

It would be nice if we provided something similar.

Severity: -- → N/A
Priority: -- → P2
Whiteboard: [necko-triaged]

I checked on Chrome and in the case where it's turned off, they just return a 401 not authorized (no UI).

They never even send the request, just return immediately.

Easy place to test:

http://httpbin.org

Whiteboard: [necko-triaged] → [necko-triaged][necko-priority-new]

I understand the requirement here is that we want to add a pref that disables Basic auth over unencrypted HTTP.
Seems easy enough. Let's try to do it.

Keywords: parity-edge
Whiteboard: [necko-triaged][necko-priority-new] → [necko-triaged][necko-priority-next]
Points: --- → 1
Assignee: nobody → sekim

Can be tested with http://httpbin.org/basic-auth/user/pass.

Hello Valentin, do we need a separate error page for this patch?

Flags: needinfo?(valentin.gosu)

No, I don't think we need a separate one. But I assume bug 1325876 will also cover this.

Flags: needinfo?(valentin.gosu)
See Also: → 1325876

We should complete the patch once bug 1325876 is landed.

Depends on: 1325876
See Also: 1325876 →
Blocks: necko-error
No longer depends on: 1325876
Attachment #9442506 - Attachment is obsolete: true
Whiteboard: [necko-triaged][necko-priority-next] → [necko-triaged][necko-priority-queue]
Summary: Provide a mechanism to disable Basic HTTP Auth (Policy or otherwise) → Provide a mechanism to disable Basic HTTP Auth by default
Attachment #9431273 - Attachment description: Bug 1763671 - Part 1: Add a preference to disable basic HTTP Auth r=#necko,mkaply → Bug 1763671 - Part 1: Add a preference to disable basic HTTP Auth by default r=#necko,mkaply
Attachment #9461108 - Attachment description: Bug 1763671 - Part 3: Enable the pref in the tests that previously used Basic HTTP Auth r=#necko → Bug 1763671 - Part 3: Enable network.http.basic_http_auth.enabled in the tests that previously used Basic HTTP Auth r=#necko
Attachment #9461108 - Attachment is obsolete: true
Attachment #9431273 - Attachment description: Bug 1763671 - Part 1: Add a preference to disable basic HTTP Auth by default r=#necko,mkaply → Bug 1763671 - Part 1: Add a preference to disable basic HTTP Auth r=#necko,mkaply
Pushed by sekim@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/f880cb7e738e Part 1: Add a preference to disable basic HTTP Auth r=necko-reviewers,fluent-reviewers,kershaw,valentin https://hg.mozilla.org/integration/autoland/rev/5a616a48f9fd Part 2: Add a test for a preference to disable basic HTTP Auth r=necko-reviewers,kershaw,valentin

https://hg.mozilla.org/mozilla-central/rev/f880cb7e738e
https://hg.mozilla.org/mozilla-central/rev/5a616a48f9fd

Status: NEW → RESOLVED
Closed: 1 year ago
status-firefox136: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 136 Branch
See Also: → 1944926
Summary: Provide a mechanism to disable Basic HTTP Auth by default → Provide a mechanism to disable Basic HTTP Auth
See Also: → 2019322
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: