269966 - FireFox brings up Authentication dialog when browsing a new Visual Studio .NET 2003 web application

Status: RESOLVED DUPLICATE of bug 267080

(Firefox :: General, defect)

Description

[D. Grimaldo]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

I created a new Web Application project with Microsoft Visual Studio .NET 2003.
I am then able to access the .NET web application using a browser.

With IE it always works out of the box the first time. With FireFox attempts to
access this same new web application project brings up an authentication dialog
with: 
    "Enter a username and password for "" on <URL>"

Eventually (by some random miracle I haven't been able to figure out) FireFox
will be able to browse it. How, I don't know, but lots of things have to happen
before I can use FireFox with the new web projects.

The (default) page of the web application (nor any within the project) have, nor
bring up an authentication request. Internet Explorer accesses the page without
problems. FireFox simply brings up this dialog and the user gets stomped.

Reproducible: Always
Steps to Reproduce:
1. Create a Web Shared project on the local machine, say http://localhost/MyWebApp
2. Create a Visual Studio .NET 2003 Web Application project that points to
http://localhost/MyWebApp
3. Attempt to access the web application at http://localhost/MyWebApp/ with
Internet Explorer
4. Attempt to access same page (http://localhost/MyWebApp/) with FireFox 1.0

Actual Results:  
With Internet Explorer 6.0 the page is displayed, no questions asked.
With FireFox the user gets a user authentication dialog asking for username and
password for ""

Expected Results:  
It should NOT ask for user authentication, there is no authentication requested
by the page requested. Internet Explorer does it fine.

Microsoft Windows XP Professional SP1
Microsoft .NET Framework v1.1
Microsoft Visual Studio .NET 2003
Microsoft Internet Information Services
Microsoft Internet Explorer 6.0 SP2
FireFox Browser 1.0 (14 Nov 2004)

Comment 1

[Phil Ringnalda (:philor)]

Is authentication required for http://localhost/ - particularly
http://localhost/favicon.ico (or anything that or a 404 for that might redirect to)?

Comment 2

[D. Grimaldo]

Further investigation on my part (and a hint from microsoft.newsgroups) 
revealed the following headers were being sent to the client (used dHTTP 
utility):

WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM

I was then told by someone in the newsgroup that Internet Explorer is able to 
handle this automatically without user intervention. FireFox does not...

What happens is that whenever a website is created on the local machines (IIS) 
by default it sets it to Integrated Windows Authentication. That is why these 
two headers appear. Then again being Microsoft they know these things and 
handle it behind the curtains.

I disabled the "Integrated Windows Authentication" for the website in question 
and it now works. HOWEVER, I do not consider the problem "fixed" because:

a) The user has to manually reconfigure the local web-share. If the user has 
no administrative rights then (s)he is unable to do any development until a 
gracious administrator comes by to do the fix.

b) By default all IIS local web-shares are created like that (for security 
reasons). The workaround was to allow anonymous access (to my local computer) 
which is not what I intended.

So perhaps FireFox can also add this behind the curtains Integrated Windows 
authentication to its impressive list of features.

Comment 3

[D. Grimaldo]

ANother reason why this IS a bug:

Try to access the following public site: http://www.usma.ac.pa/

rather than getting the default page you will get an authentication dialog.

Comment 4

[Mirjam Kroonder]

We have the same problem. Starting a webapplication in FireFox brings up a login
window.
We are developing a webapplication that is supposed to be a part of a single
sign-on solution. Therefore it's important to keep the Windows Integrated Logon
in the website.
After login the application seems to work until I try to access a webservice
(authentication with WSE 2.0 SP2) where the credentials seem to be lost again.

We are using Windows 2000 / Windows XP with FireFox 1.0.

Comment 5

[Mirjam Kroonder]

Further searching the net led me to a user configuration that solved all my
problems. On this website
(http://www.koldark.net/archives/2004/08/26/ntlm_in_firefoxmozilla.php) is
explained how to add trusted URI's in the config file. Adding 'localhost' at
network.automatic-ntlm-auth.trusted-uris makes FireFox pass my credentials
without popping-up the username/password dialog.
So not a bug, but could have some better documentation. Maybe it's possible to
maintain this list from options/web features. An extra checkbox 'allow passing
credentials to websites' with a button for the allowed sites, like 'install
software' or 'allow popups'.

Comment 6

[:Gavin Sharp [email: [e-mail]]]

This was fixed by bug 231529.

*** This bug has been marked as a duplicate of 267080 ***