259125 - Viewing Outlook Web Access (Exchange 6) causes an infinite request/response loop due to bad HTTP Auth

Status: RESOLVED FIXED

(www.mozilla.org :: General, defect)

Description

[Jay Rossiter]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20040911 Firefox/0.10
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20040911 Firefox/0.10

My company uses a stock Exchange 6 installation with Outlook Web Access enabled.
 (Sorry, I can't provide a login to test.)

Using Firefox 0.9.3, the page loads and operates normally.
Using Firefox 0.10.0 (20040911) the site prompts for username and password (via
HTTP-Auth), but the page never loads.  No page UI is ever displayed.

IE, of course, works fine.

Using LiveHTTPHeaders, it appears that Firefox is providing badly
hashed/encrypted login strings, and gets into an infinite request loop with the
server.  (See additional information.)

For each GET request, the Negotiate header uses a different hash string, varying
in length

Reproducible: Always
Steps to Reproduce:
1.  Visit OWA site
2.  Enter user/pass in HTTP Auth dialog
3.  Watch LiveHTTPHeaders for looping requests

Actual Results:  
Infinite loop of requests

Expected Results:  
Site display

These are two separate request/response headers from the infinite loop that
occurs after requesting the site.

---------

GET /exchange/ HTTP/1.1
Host: www.pctest.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20040911
Firefox/0.10
Accept:
text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Authorization: Negotiate [44 byte hex string removed for my security]

HTTP/1.x 401 Unauthorized
Content-Length: 83
Content-Type: text/html
Server: Microsoft-IIS/6.0
WWW-Authenticate: Negotiate [248 byte hex string removed for my security]
MicrosoftOfficeWebServer: 5.0_Pub
X-Powered-By: ASP.NET
Date: Mon, 13 Sep 2004 16:27:53 GMT

---------------------

GET /exchange/ HTTP/1.1
Host: www.pctest.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20040911
Firefox/0.10
Accept:
text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Authorization: Negotiate [string removed]

HTTP/1.x 401 Unauthorized
Content-Length: 83
Content-Type: text/html
Server: Microsoft-IIS/6.0
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
WWW-Authenticate: Basic realm="www.pctest.com"
MicrosoftOfficeWebServer: 5.0_Pub
X-Powered-By: ASP.NET
Date: Mon, 13 Sep 2004 16:27:52 GMT

Comment 1

[Wolf [:wolf]]

Only peers are allowed to grant blocking flags. Please request blocking-1.0?
only.  :-) Unless you've been instructed by a peer to grant it, in which case,
please note that on the bug to prevent a message like this. Thanks. 

Comment 2

[Jay Rossiter]

http://www.mozillazine.org/talkback.html?article=5264

Asa Dotzler writes "We took one more important change into the builds last
night, moving from a blacklist to a whitelist for external protocol handlers, so
today's builds are the new candidate 1.0PR builds. If all goes well with these
builds, they'll become the official Firefox 1.0 Preview Release builds on
Tuesday morning. Please help us test these bits and if you find any major
regressions, please file bugs and nominate those as PR blockers with the bug
flag "blocking-aviary1.0PR?" so that the Aviary team will see.

Comment 3

[Jay Rossiter]

May be fixed in 20040913 nightly.  Will investigate further.

Comment 4

[Jay Rossiter]

Fixed in 20040913

Comment 5

[Reed Loden [:reed]]

--> Websites :: www.mozilla.com so timeless can close out Firefox :: Product Site.