Open Bug 267203 Opened 20 years ago Updated 2 years ago

RSS feeds always prompt for user/password (login/authentication/credentials) on each startup

Categories

(MailNews Core :: Feed Reader, defect)

Product:
MailNews Core
Component:
Feed Reader
Type:
defect

Tracking

(Not tracked)

People

(Reporter: mark, Unassigned)

References

(Depends on 1 open bug)

Details

(Whiteboard: [blocked on toolkit bug 223636 which has draft patch])

Attachments

(2 files)

Screenshot "authentication required", example 1
9.61 KB, image/png
Details
Screenshot "authentication required", example 2
9.48 KB, image/png
Details 
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041028 Firefox/1.0RC1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041028 Firefox/1.0RC1

Once I've added a feed with a username/password for authentication, I shouldn't
have to click OK on the user.password dialog when ever Thunderbird starts up. 
The details are remembered, so I shouldn't be prompted again.

Reproducible: Always
Steps to Reproduce:
1.
2.
3.
Confirming in Thunderbird 0.9.
I agree with reporter. Our internal company feed uses basic password
authentification over SSL connection. Everything works fine, but clicking OK in
the password dialog on each Thunerbird startup is tiresome - given the fact that
TB remembers all required data.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: polish
is there a test feed with authentication which we could use?
(In reply to comment #2)
> is there a test feed with authentication which we could use?

You could use the RSS feed at easytree.org
You need to registrer first, but I have been bugged 0 times since I registered.
Same problem here. This *is* tiresome.
I can vouch for the bug. I use basic auth to access RSS feeds for "friends only"
posts at LiveJournal. You can test this using anyone's blog on LJ by providing
the username/password in the url:

http://username:password@www.livejournal.com/~blogowner/data/atom?auth=digest

(make sure to substitute the name of an actual blog for "blogowner")

This is how LiveJournal allows people to check for "friends only" posts by
bloggers. I ran Ethereal during TB's RSS update and it's obvious that TB simply
doesn't pass along the username and password in random cases. Sometimes it
works, sometimes it doesn't. Actually, it wasn't a problem when I only had one
RSS feed with authentication, but I recently change several other LJ feeds to
include my authentication, and now I get the login dialog at least once per update.
This bug has just gotten worse for anyone who subscribes to multiple LiveJournal feeds via Thunderbird, because LiveJournal just changed to forcing each user into their own sub-domain (e.g. username.livejournal.com). Since Thunderbird stores and prompts for passwords on a per-subdomain basis, on startup Thunderbird now not only asks once for a LiveJournal login like it used to, but for every single feed. For an LJ addict like me, that's about 30 password prompts on startup, even though the password is stored in the Password Manager.

Please fix!
I'm experiencing the same problem with corporate feeds that are protected by a username/password. Even though the information is retained (so I just have to click okay), it's still very annoying especially if you have a lot of feeds, to have a click okay a dozen times when starting up TBird! (using 1.5).
This is more than a polish issue.
Keywords: polish
Summary: RSS support prompts for user/password on each startup → RSS always prompts for user/password (login/authentication/credentials) on each startup
*** Bug 356420 has been marked as a duplicate of this bug. ***
See also bug 354258.
Marked bug 324146 as a duplicate of this one.  This issue is still outstanding and is substantial enough that the RSS portion of TB simply is unusable for my purposes.

For many of the authenticated feeds (IBM, Livejournal), I simply have the forums email me with updates.  I consider this to be a functional workaround, but this should be unnecessary.

How do we get this picked up by someone with resolver skill?
*** Bug 324146 has been marked as a duplicate of this bug. ***
This bug has been around for a long time. Any chance of getting this fixed? It's  greatly annoying and limits TB's usefulness as an RSS feedreader. Thanks!
I second Zer0(In reply to comment #13)
> This bug has been around for a long time. Any chance of getting this fixed?
> It's  greatly annoying and limits TB's usefulness as an RSS feedreader. Thanks!
> 

I second that.
QA Contact: rss
Hi

It's been about half a year now since last comment, TB2 is at 2.0.0.4 but this problem still exists. Big problem, which shouldn't be that difficult to fix for someone who knows the code. 

I really don't want to switch to a separate feed reader, but right now it's four OK clicks every startup and I'm probably lucky to have so few different auth feeds!
(In reply to comment #16)
> Hi
> 
> It's been about half a year now since last comment, TB2 is at 2.0.0.4 but this
> problem still exists. Big problem, which shouldn't be that difficult to fix for
> someone who knows the code. 
> 
> I really don't want to switch to a separate feed reader, but right now it's
> four OK clicks every startup and I'm probably lucky to have so few different
> auth feeds!
> 

Forgot to ask in the last comment: someone more knowledgeable, can this be fixed with an Add-on?
This bug is not Windows specific. I'm experiencing the problem here with Thunderbird 2.0.0.4 on Mac OS 10.4.10.
OS: Windows XP → All
Hardware: PC → All
This bug is already 3 years old. Any chance to see it fixed?
There is an "Auto Auth" addon that does this exact thing for Firefox. Perhaps contacting the author is a good idea and have him take a look at this.
I really would like to see this bug solved, since it is distracting everytime to confirm my username and password. Especially because TB knows both of them.
I have installed Auto Auth in Thunderbird and it works as expected.

http://www.chrisfinke.com/addons/autoauth/
Bug 223636 should be the core fix...
Assignee: mscott → nobody
Depends on: 223636
Summary: RSS always prompts for user/password (login/authentication/credentials) on each startup → RSS feeds always prompt for user/password (login/authentication/credentials) on each startup
This is a weird UI inconsistency; marking wanted-thunderbird3+.
Flags: wanted-thunderbird3?
Flags: wanted-thunderbird3? → wanted-thunderbird3+
Same problem here with Thunderbird 2.0.0.16.

This problem has been reported in 2004 with version 0.9!

I also had password problems (with HTTP proxies) in FF2, hopefully they got fixed with FF3, but I'm tired with this!

Can't someone write a fix to manage these RSS HTTP passwords properly?
Priority: -- → P3
Target Milestone: --- → Thunderbird 3.0rc1
Same problem in 2.0.0.17 (20080925)

AutoAuth is not a perfect solution, because:
1) It's hard to find it, may be one should add information about it into FAQ?
2) Window with password confirmation still appearing, but now it immidiately closing. It's ok if you have less than ten subscriptions, but when you have 30+ it become annoying.
I just added a password protected RSS feed, and promptly noticed this bug (no pun intended).  Any progress on fixing it?  The password is clearly saved, so it's pretty clunky that I should have to click "OK" every time I start TB for what appears to be no good reason...
#22 is still the only available solution Mattias, while #28 has valid criticism from Anton. for your single passworded feed, it should do well enough, though.
Just installed TB3beta1, and after 4 years this bug still exists.
Version: unspecified → Trunk
Thanks Leho!  That works like a charm.  This is perhaps a stupid idea, but until it's fixed, could there be a message that informs the user about this workaround if the password is saved when using an RSS feed?  It's a little steep to expect folks to digest 30 or so comments, if they even find this thread.  Most people would probably live with the problem, or just delete the RSS feed.
Component: RSS → Feed Reader
Product: Thunderbird → MailNews Core
Still bugged in TB 3.0 RC1... Seriously...

I really don't understand why it can NOT ask the email password, but has to ask the RSS password (although it's stored...). This is annoying, and I can't imagine it being hard to fix.
PS: the AutoAuth solution does not yet work with TB3.
Same problem in TB3.0 final release...
I no more use Thunderbird for RSS flows.....
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7pre) Gecko/20091209 Lightning/1.0b2pre SeaMonkey/2.0.2pre - Build ID: 20091209000712

I had this problem in the past, but it has disappeared spontaneously a few days ago, see bug 528894.
i found out my dumbusers now click close button on the password dialog, because it pops up 6 times during thundebird startup for 6 RSS feeds. it's something they don't understand, so i guess they do the "right" thing by declining, even though everything is filled out. does anyone following this bug actually know what needs to be done in code to get this to go away?
I have this problem too. It occoured in Thunderbird 2.x as well in my currently used 3.0.6 (the Ubuntu package version). This bug exists since 2004 -- could somebody please fix it? It is very annoying to klick this dialogs on each startup. I think about switching back to another feed reader and mail client :(
I've never built and don't have a working build environment, but I would expect that when opening a master password prompt, there could be a random but small delay, then a check for open dialogs (either scanning some sort of low level structure, or checking a status bit somewhere which is less desirable).  If there's already an open master password prompt, keep the other "windows" from popping up until the other window is closed.  Once the other window is closed, re-check to see if we're authenticated to the password store, and if so, continue whatever process needed auth rather than requesting password again.
The bug is still alive and kicking in TB 3.1.9 and a pain in the a**, because I have several password-protected feeds. I am also voting for getting it fixed. If I find out how, I will add a screenshot or two.
+1

Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.2.15) Gecko/20110303 Lightning/1.0b2 Thunderbird/3.1.9
Just found a quick workaround:

1) Download AutoAuth Plugin (mentioned earlier in the comments)
V2.1 -> https://addons.mozilla.org/mobile/downloads/file/108175/type:attachment/autoauth-2.1-fx+fn.xpi?src=version-history

2) Open the .xpi with 7zip (or similar) and edit the install.rdf
add ->

<!-- Thunderbird -->
<em:targetApplication>
  <Description>
    <em:id>{3550f703-e582-4d05-9a08-453d09bdfdc6}</em:id>
    <em:minVersion>2.0</em:minVersion>
    <em:maxVersion>3.1.*</em:maxVersion>
  </Description>
</em:targetApplication>

3) Install in TB 3.1
(In reply to comment #47)
> Just found a quick workaround:
> 
> 1) Download AutoAuth Plugin

My workaround without tweaking and installing an add-on has been FreeMyFeed (http://freemyfeed.com) lately. It works nicely, even though a real bugfix would be clearly preferable. Any workarounds just help to buy time...
The problem is still present in the TB 5.0
It is really annoying because I need RSS feeds to be updated often and each time TB tries to update them I get these popups. They appear right in the middle of me typing the code so even the login gets messed in the window.
The issue is there since 2004. Can it be fixed finally?
just install Addon Compatibility Reporter and disable version checking for Auto Auth. i'm almost certain this thing isn't getting much attention since workaround works well enough for large majority.
Leo, thanks for the response. Even after installing Addon Compatibility Reporter I'm still unable to install AutoAuth as-is in my TB 5.0. I've made the change to install.rdf similar to the one described by brian (comment #47) and that helped.

The thing is that criticism in comment #28 still applies. I don't think that it's a correct way to do things. 

As far as I understand the problem itself lies somewhere in the base Mozilla code which is used by all the products. The workaround with the AutoAuth is not perfect and hard to find. E.g. this problem is bugging me for more than a year, and only today I finally found this bugzilla issue. 
It was easier for me to go looking for alternatives to TB.. (Though I was unable to find any..)
And another thing is that the AutoAuth does not seem to work for TB 5.0 anyway.
TB 7.0 is released already, and the issue is still present. Are there any reasons for not fixing it?
(In reply to Mikhail Barg from comment #53)
> TB 7.0 is released already, and the issue is still present. Are there any
> reasons for not fixing it?

Because you didn't submit a patch :-)
Nice point, thanks. I've tried a few weeks ago to find the roots of the issue, but failed even to find the proper source code repository for the Thunderbird. 

I do know nothing on the TB/Mozilla code structure and also I am worried about the dependency tree for this issue.. So I expected that somebody with deeper knowledge of the TB internals could finally do something about this issue.. It's already 7 years of it being there..
#maildev on mozilla irc. going at it completely alone is probably a process lengthier than it needs to be simply due to the size of the codebase. re irc, while many of my various TB-features questions have simply been ignored, a lot have also gotten quite immediate responses from the existing dev crowd. its a good way to gauge actual multiparty interest in whatever youre trying to hack up for thunderbird. i'm also in the process of getting to know TB source better and getting to a point where i can build my own, so i might be able to put in some work on this feature as well.
Thanks for pointing me there, I will see if I can find appropriate time in my schedule to finally tackle this problem..
(In reply to Mikhail Barg from comment #55)
> Nice point, thanks. I've tried a few weeks ago to find the roots of the
> issue, but failed even to find the proper source code repository for the
> Thunderbird. 

For Thunderbird 7, you might try http://hg.mozilla.org/releases/comm-release/

Of course, like all trees other than trunk, it is approval-required.
P.S. For Thunderbird trunk (which should be fixed first) it is of course comm-central, http://hg.mozilla.org/comm-central/ and rather than clone (which might use a lot of time and bandwidth) you may prefer to install a bundle, see
http://benjamin.smedbergs.us/blog/2008-06-05/getting-mozilla-central-with-limited-bandwidth/ (mutatis mutandis for comm-central vs. mozilla-central)
https://developer.mozilla.org/En/Developer_Guide/Source_Code/Mercurial#Bundles
Checking the dependency graph for this issue it seems that if the issues
https://bugzilla.mozilla.org/show_bug.cgi?id=223636 and 
https://bugzilla.mozilla.org/show_bug.cgi?id=513408
are fixed, this current issue would be solved automatically.

Still it seems to be more general design issues..
I've experiences this same bug for several years on Windows, Linux, and OS X. I filed a bug report (https://bugzilla.mozilla.org/show_bug.cgi?id=676452) because Thunderbird will freeze completely if you are using the mouse to move a message to a folder at the time that the authentication dialog pops up.

In the comments to the bug report, I documented that the prompt for the RSS password actually stopped appearing for a few months when I switched computers and Thunderbird versions.
The bug still exists in 23.0b1 on Win7 x64, NINE freaking years after it was first reported!
Had to install the add-on as well, because it will probably take the Thunderbird developers another couple of decades.
Please fix this... I'm on Linux 24.1.1 and all of a sudden it's not just prompting at startup, it's prompting EVERY TIME it checks. It's so freaking annoying.
Amen to that
Soon we can celebrate the 10 years jubilee!
I encountered this problem im Seamonkey 2.26.
+1 Flex!
This is indeed an issue on TB30 b3. Some feeds are properly working, with password stored in the database, but a couple of new ones just aren't getting saved.
TB 31.3.0 doesn't even show the Password Manager checkbox to me anymore on in the authentication dialog. What's going on with that?
Damn. We missed the 10th anniversary-party for this bug. :(
Guess the 15th will also be a nice jubilee then!

I'd even donate some money for Thunderbird if it just was possible. Unfortunately you can only donate to Mozilla Foundation in general which means that the money will rather arrive in Firefox OS projects...
There's a signon.debug switch. I'd recommend people interested in flipping this on and let's find some insight.

For the life of me I can't figure out how do I copy more than one row of output at a time out of Error Console.
(In reply to Leho Kraav (:macmaN @lkraav) from comment #70)
> For the life of me I can't figure out how do I copy more than one row of
> output at a time out of Error Console.
With https://addons.mozilla.org/thunderbird/addon/console²/
thanks :merike, forgot about that one.

so this is copy-paste after clearing the log, then doing right-click and Get Messages on a http auth protected feed folder. here i click Cancel and stop the operation.

there is no checkbox available in the authentication dialog for remembering the password, so to me it doesn't even make sense to continue with anything else until that checkbox is back with us.

message ordering is Last to First, so it'd be logical to read.

2014-12-13 17:42:27	Feeds	INFO	downloaded: Update: RSS/Allen Latest updates -> https://basecamp.com/2581033/projects/5408130.atom could not be found. Please check the name and try again.

 ----------
Error: syntax error
Source file: https://basecamp.com/2581033/projects/5408130.atom
Line: 1, Column: 1
Source code:
HTTP Basic: Access denied.
 ----------
Pwmgr PrompFactory: _doAsyncPrompt:run bypassed, no prompts in the queue
 ----------
Pwmgr PrompFactory: Calling back to [xpconnect wrapped nsIAuthPromptCallback] ok=false
 ----------
Pwmgr Prompter: Notification bars not available on window
 ----------
Pwmgr Prompter: Unable to get notify window
 ----------
PwMgr mozStorage: Getting login saving is enabled for https://basecamp.com
 ----------
Login Manager: Checking if logins to https://basecamp.com can be saved.
 ----------
Pwmgr Prompter: found 0 matching logins.
 ----------
PwMgr mozStorage: _findLogins: returning 0 logins
 ----------
PwMgr mozStorage: _searchLogins: returning 0 logins
 ----------
Login Manager: Searching for logins matching host: https://basecamp.com formSubmitURL: null httpRealm: Application
 ----------
Pwmgr Prompter: Notification bars not available on window
 ----------
Pwmgr Prompter: Unable to get notify window
 ----------
Pwmgr Prompter: Popup notifications not available on window
 ----------
Pwmgr Prompter: Unable to get notify window
 ----------
Pwmgr Prompter: ===== promptAuth called =====
 ----------
Pwmgr PrompFactory: _doAsyncPrompt:run - performing the prompt for '2|https://basecamp.com|Application'
 ----------
Pwmgr PrompFactory: _doAsyncPrompt:run dispatched
 ----------
PwMgr mozStorage: _countLogins: counted logins: 0
 ----------
Login Manager: Counting logins matching host: https://basecamp.com formSubmitURL: null httpRealm: Application
 ----------
Pwmgr Prompter: Adding new prompt to the queue, callback = [xpconnect wrapped nsIAuthPromptCallback]
 ----------
Pwmgr Prompter: Async prompt key = 2|https://basecamp.com|Application
 ----------
Pwmgr Prompter: Notification bars not available on window
 ----------
Pwmgr Prompter: Unable to get notify window
 ----------
Pwmgr Prompter: Popup notifications not available on window
 ----------
Pwmgr Prompter: Unable to get notify window
 ----------
Pwmgr Prompter: ===== asyncPromptAuth called =====
 ----------
Pwmgr Prompter: ===== initialized =====
https://addons.mozilla.org/en-US/thunderbird/addon/saved-password-editor/?src=search allows us to create custom entries in the password database, effectively filling the gap of this bug going unfixed for ages. Awesomeness.
Hi Leho, I'm now using Postbox, which still has the bug (once each session I must click OK on a password prompt, but the name/password are already filled in), but apparently Postbox is not compatible with this add-on.

Were you having the same problem and using this add-on made the problem disappear? I don't quite understand, because it's clear that my password is already saved in the password database, so I don't understand how this add-on would help.

If it really does fix it, then I'll install Thunderbird and fix my profile, which presumably would then work correctly in Postbox.
Re Postbox: In the Thunderbird dev cycle, we will accept changes that result in failures if users run a modern Thunderbird, and then downgrade to a version of Thunderbird prior to Thunderbird 17. Postbox branched from Thunderbird prior to version 3, and it is unknown how much functionality they have backported. So I would not automatically assume that you could run Thunderbird, then run the same profile on Postbox.
Postbox 3 - the latest - is (according to mozillazine) using the same platform that was Thunderbird 7.
So, at this point it probably has most of the  security holes that were fixed in mozilla products the last 4 years.
Eric, you're right, this bug actually has a split personality for me.

1. Saved passwords are not getting automatically used
2. Some (exact criteria unknown) login and password combos are not getting saved at all, despite repeated form fills (comment 67)

They may or may not have the same underlying mechanism responsible. Pointers to more related bugs are welcome here.

SPE addon fixes scenario 2, which is even worse, because you have to manually copy/paste from another password db like KeePass on every Thunderbird startup.

But yes, I still have to "Enter" key currently through 4 authentication prompts, an amount which can only increase. Still, thanks to SPE, my life is incrementally better now and I can focus on looking for a solution to scenario 1.
Removing myslef on all the bugs I'm cced on. Please NI me if you need something on MailNews Core bugs from me.
11 years of not resolving this bug? Just close it then and be a man about it.

My (horrible) solution is an AutoHotkey script which keeps feeding the password (stored in the AutoHotkey script) into the login dialog - and even that is a big pain because Thunderbird drops key events under heavy CPU load (and when it polls for new messages it is making heavy use of the CPU), so additional synchronization is necessary.

Who knows how many people use a similar hack/solution - security-ad-absurdum forced by an 11 year old bug.
(In reply to clemens from comment #79)
> 11 years of not resolving this bug? Just close it then and be a man about it.
> 
> My (horrible) solution is an AutoHotkey script which keeps feeding the
> password (stored in the AutoHotkey script) into the login dialog

A better workaround is to use the Saved Password Editor.
After you entered the password you'll get the thunderbird password prompt
with username and password filled and only have to hit enter.
See here:
https://addons.mozilla.org/de/thunderbird/addon/saved-password-editor/
(In reply to clemens from comment #79)
> 11 years of not resolving this bug? Just close it then and be a man about it.

It's a shame.
According to the annual report of Mozilla, they spent 340 Mio $ for software development in 2012 and 2013 and did not pay one single permanent programmer for Thunderbird:
https://static.mozilla.com/moco/en-US/pdf/Mozilla_Audited_Financials_2013.pdf
(In reply to Stefan Fleiter (:sfleiter) from comment #80)
[...]
> > My (horrible) solution is an AutoHotkey script which keeps feeding the
> > password (stored in the AutoHotkey script) into the login dialog
> 
> A better workaround is to use the Saved Password Editor.
> After you entered the password you'll get the thunderbird password prompt
> with username and password filled and only have to hit enter.
> See here:
> https://addons.mozilla.org/de/thunderbird/addon/saved-password-editor/

Thanks for the tip, but not working for the RSS feeds login dialogs of Thunderbird for me.

That add-on mentions that it may not work on some sites (?) and refers to further possible add-ons as solution. (I have not tried these alternatives.)
(In reply to Flex from comment #81)
> (In reply to clemens from comment #79)
> > 11 years of not resolving this bug? Just close it then and be a man about it.
> 
> It's a shame.
> According to the annual report of Mozilla, they spent 340 Mio $ for software
> development in 2012 and 2013 and did not pay one single permanent programmer
> for Thunderbird:
> https://static.mozilla.com/moco/en-US/pdf/Mozilla_Audited_Financials_2013.pdf

- They should start accepting donations (crowdsourcing?) (esp. from professionals and companies whose employees are relying on Thunderbird) solely for Thunderbird development.

- They should never ever contemplate and discuss adding ads or anything related to ads as a means for fundraising again.

- They should add annual (or so) tooltips (wikipedia style) to point out that fundraising started to finance further development. This is required in my opinion to raise awareness that software development and maintenance costs money. (If you want "free", go to Google & co. and trade-in your privacy, have fun.)
After this problem did not appear for a while (for some reason) it still seems to exist at least in Seamonkey 2.39.
Priority: P3 → --
Whiteboard: [blocked on toolkit bug 223636 which has draft patch]
Target Milestone: Thunderbird 3.0rc1 → ---
Bug still exists (Linux/TB45.1.1), RSS from Alfresco. SPE not working for the RSS feeds login dialogs of Thunderbird for me.
Bug still exists (Linux/52.2.), password protected RSS from Alfresco. SPE not working for the RSS feeds login dialogs of Thunderbird for me.

Hello!
Thunderbird authentication in RSS not worked.
No select authentication user and password in RSS Thunderbird.
But authentication parameters may selected in URL for RSS.
For example: http://USR:PSSWD@www.company.org/rss
Thunderbird authentication in RSS not worked.

Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: