1908115 - Regression: NTLM credentials are erroneously requested on location.reload

Status: RESOLVED FIXED

(Core :: Networking, defect, P1)

Description

[gserg.g]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0

Steps to reproduce:

Regression in v128 compared to v127.0.2.

We have a local intranet portal that requires Windows authentication.
Its domain name is added to Firefox's network.automatic-ntlm-auth.trusted-uris so that Firefox sends the NTML credentials automatically.
That works.

Some pages on that portal include a javascript line location.refresh(true); to force a refresh on a timer. That has stopped working in 128 as compared to 127.0.2.

Actual results:

Starting from Firefox 128, executing location.refresh(true); results in a user prompt for credentials. Failure to provide them results in HTTP 401.

This was not the case in versions 127.0.2 and older.

Verified by rolling back to 127.0.2 and not observing this behaviour there.

Expected results:

location.refresh(true); should silently succeed.

Comment 1

[gserg.g]

Err:

location.reload(true), like in the title, not location.refresh(true) like in the report text. Sorry.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Networking' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 3

[Sunil Mayya]

Hello gserg.g,
Thank you for reporting the issue promptly.
Could you please share the http logs for the issue?
We had made recent changes to our auth behavior.
Could you please confirm if the issue no longer exists once you change the pref network.auth.use_redirect_for_retries to false

Comment 4

[Sunil Mayya]

Keeping this in priority review queue until we get the logs from the reporter.

Comment 5

[gserg.g]

Attachment: firefox_log.txt-main.13936.zip

HTTP logs requested

Comment 6

[gserg.g]

(In reply to Sunil Mayya from comment #3)

Could you please share the http logs for the issue?

Please find attached.

Could you please confirm if the issue no longer exists once you change the pref network.auth.use_redirect_for_retries to false

I can confirm. That fixes it.

Comment 7

[Sunil Mayya]

We are going to disable this pref and release it soon.

Comment 8

[Sunil Mayya]

Attachment: Bug 1908115 - disable network.auth.use_redirect_for_retries for release. r=#necko

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/92302f29e4e1
disable network.auth.use_redirect_for_retries for release. r=necko-reviewers,kershaw

Comment 10

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/92302f29e4e1

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1896350

Comment 12

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:smayya, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox129 to wontfix.

For more information, please visit BugBot documentation.

Comment 13

[Sunil Mayya]

[Tracking Requested - why for this release]:
We should fix this in 128

Comment 14

[Sunil Mayya]

Comment on attachment 9413267 [details]
Bug 1908115 - disable network.auth.use_redirect_for_retries for release. r=#necko

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: This affect users using NTLM authentication.
• User impact if declined: Authentication will fail.
• Fix Landed on Version: 130
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This pref restores firefox's old behavior for authentication which has been deployed for users for a long time.

Comment 15

[Donal Meehan [:dmeehan]]

Sunil, your ESR uplift request mentions the fix landed in Fx129 but the patch landed in central for Fx130?

You mention in Comment 13 that this should be fixed in Fx128.
Could you add both a beta and a release uplift request?
We could include this in beta for Fx129 and the scheduled dot release for Fx128

Comment 16

[Sunil Mayya]

Comment on attachment 9413267 [details]
Bug 1908115 - disable network.auth.use_redirect_for_retries for release. r=#necko

Beta/Release Uplift Approval Request

• User impact if declined: NTLM auth might fail
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The patch restores old stable auth behavior of firefox before 128
• String changes made/needed:
• Is Android affected?: Yes

Comment 17

[Sunil Mayya]

Comment on attachment 9413267 [details]
Bug 1908115 - disable network.auth.use_redirect_for_retries for release. r=#necko

Beta/Release Uplift Approval Request

• User impact if declined: NTLM auth might fail
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The patch restores old stable auth behavior of firefox before 128
• String changes made/needed:
• Is Android affected?: Yes

Comment 18

[Sunil Mayya]

Thanks Donal for correcting!
I have updated the request to include the fix in beta. The fix must go for dot release for 128 and beta for 129.

Comment 19

[Donal Meehan [:dmeehan]]

Comment on attachment 9413267 [details]
Bug 1908115 - disable network.auth.use_redirect_for_retries for release. r=#necko

Approved for 129.0b7

Comment 20

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/9bffcba41e7b

Comment 21

[Donal Meehan [:dmeehan]]

Comment on attachment 9413267 [details]
Bug 1908115 - disable network.auth.use_redirect_for_retries for release. r=#necko

Approved for 128.1esr.

Comment 22

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/afc5523f1dc6

Comment 23

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9413267 [details]
Bug 1908115 - disable network.auth.use_redirect_for_retries for release. r=#necko

Approved for 128.0.2.

Comment 24

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-release/rev/dcc0c692c61a

Comment 25

[Ryan VanderMeulen [:RyanVM]]

Added to the 128.0.2 relnotes:

Fixed an issue causing NTLM authentication failure.