379997 - Logins should not be deleted if authentication fails

Status: RESOLVED FIXED

(Core :: Networking, defect)

Description

[Justin Dolske [:Dolske]]

The code in question in calling pwmgr's RemoveUser in two places, when an authentication attempt fails...

ClearPasswordManagerEntry() around
http://mxr.mozilla.org/seamonkey/source/netwerk/protocol/http/src/nsHttpChannel.cpp#4637

and 

nsFtpState::R_pass() around
http://mxr.mozilla.org/seamonkey/source/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp#817

This might seem to make sense at first glance (why store a password we know doesn't work), but it's wrong. It's not uncommon for servers to have glitches that cause valid logins to fail. For example, a front-end server being unable to contact some back-end authentication server.

Comment 1

[Christian :Biesinger (don't email me, ping me on IRC)]

for reference, the http version was added in bug 91968

Comment 2

[:Gavin Sharp [email: [e-mail]]]

And FTP in bug 114118.

Comment 3

[Justin Dolske [:Dolske]]

Attachment: DO NOT WANT

Removes the code in question.

Comment 4

[Justin Dolske [:Dolske]]

Attachment: DO NOT WANT

Oops, forgot to edit one line.

Comment 5

[:Gavin Sharp [email: [e-mail]]]

You should request review from a netwerk peer, like biesi.

Comment 6

[:Gavin Sharp [email: [e-mail]]]

mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp 	1.311
mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp 	1.309
mozilla/netwerk/protocol/http/src/nsHttpChannel.h 	1.90