38008 - Basic authentication dialog should display more information.

Status: VERIFIED FIXED

(Core :: Networking: HTTP, defect, P3)

Description

[Henrik Gemal]

The dialog that comes up for a password protected site is wrong. The following 
is wrong:
- first of all it's ugly...:)
- "Confirm password"? I haven't even entered the password once.
- The website that asks for the username/password should be included into the 
dialog.

Comment 1

[Henrik Gemal]

Attachment: IE's dialog

Comment 2

[Hugh Kennedy]

marking rfe, changing plat/os to all.. although i agree completely.

it would be nice to have a lock icon (ala PSM) to see
if the site is over SSL or not..

Comment 3

[Henrik Gemal]

Currently is also not able to localize it. Perhaps a XUL dialog would be better?

Comment 4

[Blake Ross]

You should really consider splitting off all these bugs into separate reports.

Comment 5

[Hugh Kennedy]

the psm icon bit has been moved into bug 38019.

Comment 6

[Norris Boyd]

Reassign to owner of Networking component.

Comment 7

[Gagan]

ui ui ui
ben ben ben

Comment 8

[verah (gone)]

UI text... reassigning to myself

Comment 9

[han.holl]

First of all: this is a regression. It has worked correctly for
more than one month. (I must identify myself to a Squid proxy server,
so I know).

It has to do with:
element.setAttribute("hidden", "true");
(line 201 in chrome/global/content/commonDialog.js).

If I change that line to:
element.setAttribute("sytle","visibility: collapse;");

the second element (first password) is eminently visible, but
at least, if I use the third field, I can identify myself properly.

Hope this helps.

Comment 10

[han.holl]

This seems to be a duplicate of 27784.(and a whole buch of others)
Lengthy discussion there

Comment 11

[Hugh Kennedy]

nope. read the comment from Mathew Thomas in bug 27784. that is linux-only,
and for a _completely_ inaccessable password dialog. this is an RFE not covered
by that bug.

Comment 12

[Matthew T (active 1999-2002)]

han.holl: this bug is not about the password field not working (bug 27784), it is 

about the basic authentication dialog needing better design in general. And this 

bug shouldn't be fixed before that one, because the authentication dialog is 

acting as the primary test-case for that bug.



So, let's assume that IE's dialog (as attached to this report) is better than the 

current Mozilla one -- not too much of a contentious claim, really. But what 

could still be improved from IE's dialog?

* The title refers only to a `network password', when you also have to enter a

  user name.

* The whole dialog has too much empty padding, and the horizontal and vertical

  padding is inconsistent.

* It probably shouldn't use the word `please' -- you shouldn't pretend that the

  computer actually cares about whether you decide to authenticate or not.

* It says `type your user name and password', which is inaccurate if you are

  pasting or entering your data by some method other than typing.

* If either the server name or the realm name were long (which they might well

  be), they would fall off the edge of the dialog. They should be in non-editable

  text fields, so they can be scrolled to see the entire name if they get too

  long.

* The `Realm' field is conceptually more important than the `Site' field, so

  `Realm' should come first.

* The `Site' field is poorly named, since server != `site'.

* The `Realm' field isn't aligned properly (either horizontally or vertically)

  with the rest of the dialog.

* The `User Name' and `Realm' labels should have colons, since they're not part

  of sentences.

* In `User Name', `name' doesn't need to be capitalized.

* `Save this password in your password list' is more technical and less

  results-explaining than it needs to be.

* The dialog doesn't give an option to remember the password just for the current

  session.



So, removing all those problems, we get:



+---------------------------------------------------+

|[] Log in :::::::::::::::::::::::::::::::::::::::::|

+---------------------------------------------------+

| ,.__   Enter your user name and password for      |

| `'""   realm       [Site Administration         ] |

|        at server   [www.gamal.dk                ] |

|                                                   |

|        _User name: [|                           ] |

|        _Password:  [                            ] |

|                                                   |

|        [ ] Remember these for when I log in again |

|        [ ] Remember just for this session         |

|                                                   |

| ( Help )                  ( Cancel ) (( Log in )) | <-- platform-specific order

+---------------------------------------------------+



The checkboxes would be mutually exclusive -- you could select zero or one of 

them, but as soon as you tried to check both of them the first one you had 

checked would become unchecked. This isn't ideal -- three radio buttons would be 

the technically correct solution -- but I think the simplicity would outweigh the 

slightly strange behavior in this case.



Anyone see any further room for improvement in the dialog design?

Comment 13

[Matthew T (active 1999-2002)]

Feh. Here's the design again, without Bugzilla's extra line breaks:

+---------------------------------------------------+
|[] Log in :::::::::::::::::::::::::::::::::::::::::|
+---------------------------------------------------+
| ,.__   Enter your user name and password for      |
| `'""   realm       [Site Administration         ] |
|        at server   [www.gamal.dk                ] |
|                                                   |
|        _User name: [|                           ] |
|        _Password:  [                            ] |
|                                                   |
|        [ ] Remember these for when I log in again |
|        [ ] Remember just for this session         |
|                                                   |
| ( Help )                  ( Cancel ) (( Log in )) | <-- platform-specific order
+---------------------------------------------------+

Comment 14

[Matthew T (active 1999-2002)]

See also bug 38933. Since this dialog, and the dialog required for that bug, 
carry out equivalent functions (doing authentication), we might want the first 
sentences of the dialogs to be roughly the same.

Comment 15

[Matthew T (active 1999-2002)]

*** Bug 51691 has been marked as a duplicate of this bug. ***

Comment 16

[Henrik Gemal]

Changed URL since old one didn't work anymore...

I've also filed bug 51696 to be able to access the "realm" and "server" info in 
the commonDialog.xul file.

Comment 17

[Henrik Gemal]

Attachment: Screenshot of IE, OE and NS username/password dialogs...

Comment 18

[Matthew T (active 1999-2002)]

Attachment: Mac OS's native authorization dialog

Comment 19

[Matthew T (active 1999-2002)]

Design tweaks:
* added realm to title bar (and dependency on bug 51696)
* made server/realm field labels follow Mac/Windows capitalization/punctuation
  convention
* changed to `Remember this password', because it's clearer, and remembering the
  password implies remembering the user name to use it with anyway
* added security info (and dependency on bug 38019)
* removed `Remember just for this session', because Mozilla always does (duh).

+--------------------------------------------------------+
|[] Log in to ITS :::::::::::::::::::::::::::::::::::::::|
+--------------------------------------------------------+
| ,.__  Enter your user name and password for            |
| `'""  Server:     [cantsb.canterbury.ac.nz           ] |
|       Realm:      [ITS                               ] |
|                    __________________________________  |
|       _User name: [|_________________________________] |
|       _Password:  [__________________________________] |
|                   [_] _Remember this password          |
|        ,.                                              |
|       []  This login is not using a secure connection. |
|                                                        |
| [?]                            ( Cancel ) (( Log in )) |
+--------------------------------------------------------+

Comment 20

[Dan Nunn]

I really prefer the way Netscape 4.x does it, more than anything. Also, I 
believe that a non-editable textbox with the server and the realm is the *worst* 
thing to UI-wise, as users may wonder whether or not they're supposed to fill 
in, or at least edit, the fields, and be worried when it doesn't work 
(non-editable). Besides, I've never met a realm that didn't fit in 4.x, but we 
can use trunication ("Big Bad Long Realm Of The...") if it grows too long (you 
may say that this may hide important information, but a very long realm is never 
necessary). Also, I don't believe the title should change at all. If it had to 
change at all, I'd rather that it used "Log In To [site]" rather than "Log In 
To [realm]". However, I'd still rather use "Authentication Required". Based on 
all this, I copied and pasted your dialog into Notepad and edited it (used 
Windows style button arrangements) for a fake entry with a realm of "Better 
Browser", without the quotes, and a site of www.mozilla.org:

+--------------------------------------------------------+
|   Authentication Required::::::::::::::::::::::::::::::|
+--------------------------------------------------------+
| ,.__  Enter your username and password for "Better     |
| `'""  Browser" at www.mozilla.org:                     |
|                                                        |
|                    __________________________________  |
|       _User name: [|_________________________________] |
|       _Password:  [__________________________________] |
|                   [_] _Remember this password          |
|        ,.                                              |
|       []  Remember these for when I log in again       |
|                                                        |
| [?]                           ((  OK  )) ( Cancel )    |
+--------------------------------------------------------+

Comment 21

[Henrik Gemal]

A lot of the text is inside c++ code...:
http://lxr.mozilla.org/mozilla/source/netwerk/protocol/http/src/nsHTTPChannel.cp
p#2049
bad, bad, bad...

Comment 22

[Matthew T (active 1999-2002)]

[Reassigning to component owner]

Comment 23

[neeti]

Adding to meta authentication bug

Comment 24

[Boris Zbarsky [:bzbarsky]]

*** Bug 77369 has been marked as a duplicate of this bug. ***

Comment 25

[Aleksey Nogin]

Netscape 4 used to has realm and host name in the auth dialog => 4xp keyword.
AFAIK, 4xp's are considered bugs, not RFE's

Comment 26

[Aleksey Nogin]

I filed a similar bug for NNTP authentication dialog - bug #85637

Comment 27

[[e-mail]]

+mozilla 1.0, basic design seems to have reached enough consensus where this
should be doable...

Comment 28

[Aleksey Nogin]

Is this fixed (except for bug 38019)? I see realm and host information in basic
auth dialog on BuildID 20010806000

Comment 29

[Henrik Gemal]

actually this bug is kind of fixed since this bug is about "more info". We 
currently show all the info the other browsers show.

Perhaps a new bug should be opened that has to do better better UI for the 
dialog.

Comment 30

[Henrik Gemal]

Attachment: realm dialogs in Moz, NS and IE

Comment 31

[Henrik Gemal]

v 20020222