1809151 - corporate web proxy no kerberos auth for iframe content since 108.0.1

Status: RESOLVED FIXED

(Core :: Networking, defect, P2)

Description

[[:pidpad]]

Attachment: FF_issue.png

Steps to reproduce:

corporate proxy with kerberos authentication (policy, no content without authentification)

Since FF updated to the latest version 108.0.1, we see issues with the kerberos authentication when there is embedded iframe content on a page. FF does not send any authentication for the iframe content, for the rest of the page it does.
We have the issue persistent on different laptops and virtual maschines.
When we download an older FF version the issue is not present, after the update it is.

There was no change on our coporate proxy, only the FF update.
Even in the beta and nightly the problem persists

Actual results:

the web page loads fine, except for the iframe content.
error: proxy server ist refusing the connection (because of no auth, we see it in the web proxy logs)

Expected results:

embedded iframe content should be send with kerberos authentification to the proxy an the content should load fine.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Networking' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Valentin Gosu [:valentin] (he/him)]

Thank you for the report.
Would you be able to use mozregression to determine which change introduced this bug?
Install -> Quickstart Guide

Comment 3

[[:pidpad]]

Hi Valentin,

i ran the mozregression tool and it seems that the change which intoduced this bug was the following:

app_name: firefox
build_date: 2022-11-11
build_file: C:\Users\XXX.mozilla\mozregression\persist\2022-11-11--mozilla-central--firefox-108.0a1.en-US.win64.zip
build_type: nightly
build_url: https://archive.mozilla.org/pub/firefox/nightly/2022/11/2022-11-11-09-37-17-mozilla-central/firefox-108.0a1.en-US.win64.zip
changeset: b7164776589657b7d7fd40d32268b2a489eed789
pushlog_url: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=df541ee6f62267803ead2b4e966dc2c06a23c58a&tochange=b7164776589657b7d7fd40d32268b2a489eed789
repo_name: mozilla-central
repo_url: https://hg.mozilla.org/mozilla-central

Comment 4

[Kershaw Chang [:kershaw]]

Hi Reporter,

Could you please also try to record a http log?
Please send the log to [e-mail] since it may contain some privacy information.

Thanks.

Comment 5

[[:pidpad]]

Hi Necko,

I sent you the file by e-mail.

Comment 6

[Kershaw Chang [:kershaw]]

Thanks for the log.
This looks like to be regressed by bug 1629307.

Sunil, could you take a look?
Thanks.

Comment 8

[Sunil Mayya]

Thanks Kershaw, I will have a look.

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

Based on comment #3, this bug contains a bisection range found by mozregression. However, the Regressed by field is still not filled.

:smayya, if possible, could you fill the Regressed by field and investigate this regression?

For more information, please visit auto_nag documentation.

Comment 10

[Sunil Mayya]

Since, fix for Bug 1629307 was delivered, we disable auth prompts for requests which does not allow loading of the page via iframes ( for e.g. X-Frame-Options: deny).
The rationale was that there is no point in having auth prompts when the page is not going to be successful due to CSP failures post authentication.

In this bug from the logs it is evident that the CSP policy does not allow loading of the page via iframes.

1710 2023-01-09 15:57:12.589000 UTC - [Parent 22192: Socket Thread]: V/nsHttp ParseContentType [type=text/html]                                              
....        
1716 2023-01-09 15:57:12.589000 UTC - [Parent 22192: Socket Thread]: E/nsHttp nsHttpTransaction::ParseLine [X-Frame-Options: deny]

AFAIU the header X-Frame-Options is added by the proxy and not by the site as it would deny loading the page even before our fix for Bug 1629307 was delivered.

To solve this bug we need to know if the header X-Frame-Options was added by proxy or by the original page. I think this is very difficult/impossible.

:Valentin
Please correct me if I my observations are wrong.

I propose to remove the check we introduced in 1629307 via pref until we are sure we cannot solve the auth prompt problem.

Comment 11

[Sunil Mayya]

Dear Reporter,

Thank you taking time to file this bug and providing all the required information.
As mentioned in the previous comment, we strongly suspect that the header X-Frame-Options: deny was added by the proxy and not the original website.

I visited the website https://www.golem.de/ with devtools opened.
I could not see the X-Frame-Options header.
Could you please confirm this header was added by the proxy and not by the original site? If this is the case you could try disabling it as temporary fix.
Thanks

Comment 12

[[:pidpad]]

Hi Sunil,

i guess the X-Frame-Options: deny you are seeing in the logs is the answer from the coporate proxy, because no authentication was sent for kerberos the proxy answers with a ntlm negotiate as a fallback.

I found no option to disable any X-Frame-Options.
We do not manipulate any content of the website with the proxy, we only search for malicious content.

best regards
pidpad

Comment 13

[Greg Hess]

Backout the regressing patch and reopen regressing bug. Uplift backout to beta. Moving to priority queue.

Comment 14

[edgul]

Attachment: Bug 1809151 - corporate web proxy no kerberos auth for iframe content by backout 1629307 r=#necko-reviewers

Comment 15

[edgul]

Comment on attachment 9313818 [details]
Bug 1809151 - corporate web proxy no kerberos auth for iframe content by backout 1629307 r=#necko-reviewers

Beta/Release Uplift Approval Request

• User impact if declined:
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This is just a backout.
• String changes made/needed:
• Is Android affected?: Unknown

Comment 16

[Pascal Chevrel:pascalc]

Will we also want to back out on the release branch? Thanks

Comment 17

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1629307

Comment 18

[Ryan VanderMeulen [:RyanVM]]

(In reply to Pascal Chevrel:pascalc from comment #16)

Will we also want to back out on the release branch? Thanks

Comment 19

[Kershaw Chang [:kershaw]]

Yes, I think we should.
Ed, could you request release and beta uplift? Thanks.

Comment 20

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8d52a2806191
corporate web proxy no kerberos auth for iframe content by backout 1629307 r=necko-reviewers,valentin,jesup

Comment 21

[edgul]

Comment on attachment 9313818 [details]
Bug 1809151 - corporate web proxy no kerberos auth for iframe content by backout 1629307 r=#necko-reviewers

Beta/Release Uplift Approval Request

• User impact if declined:
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This is just a backout
• String changes made/needed:
• Is Android affected?: Unknown

Comment 22

[edgul]

Yes, thanks.

Comment 23

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

corporate web proxy no kerberos auth for iframe content by backout 1629307 r=necko-reviewers,valentin,jesup
https://hg.mozilla.org/integration/autoland/rev/8d52a2806191493bd57f68590f09059bf6986c5f
https://hg.mozilla.org/mozilla-central/rev/8d52a2806191

Comment 24

[[:pidpad]]

Does the last post from Sebastian means that I can test if the problem is gone in the latest nightly build?

Comment 25

[[:pidpad]]

I can confirm, the issue is resolved in the nightly build from today.
The page is now loading without any issues again!

Comment 26

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9313818 [details]
Bug 1809151 - corporate web proxy no kerberos auth for iframe content by backout 1629307 r=#necko-reviewers

Approved for 110.0b6.

Comment 27

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/9a24b0436a32

Comment 28

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9313818 [details]
Bug 1809151 - corporate web proxy no kerberos auth for iframe content by backout 1629307 r=#necko-reviewers

Approved for 109.0.1

Comment 29

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-release/rev/5d9db71572ea

Comment 30

[Ryan VanderMeulen [:RyanVM]]

Added to the 109.0.1 relnotes:

Fixed an issue causing authentication prompts to not appear when loading pages in some enterprise environments

Comment 31

[Sunil Mayya]

Attachment: WIP: Bug 1809151: disable XFO check for proxy auth

Comment 32

[BugBot [:suhaib / :marco/ :calixte]]

A patch has been attached on this bug, which was already closed. Filing a separate bug will ensure better tracking. If this was not by mistake and further action is needed, please alert the appropriate party. (Or: if the patch doesn't change behavior -- e.g. landing a test case, or fixing a typo -- then feel free to disregard this message)