447935 - Firefox prompts user in response to 401 header returned by XHR call

Status: RESOLVED DUPLICATE of bug 282547

(Core :: DOM: Core & HTML, defect)

Description

[Tim Bender]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1

I am going to establish informative background details, please do not get hung up on these.
I am using Apache 2.0 with a directory set to HTTP Basic Authentication. A technique developed for logging users out is to submit bad authentication data for the purpose of corrupting the browsers authentication cache for that realm. I have an XHR based script that does this.

The bug:
The above mentions XHR script in turn receives a status 401 from the web server, as it should. However, rather than allowing the javascript to handle the XHR status 401, Firefox immediately launches the authentication dialog. Thus causing my script to appear to immediately prompt users to log back in.

Specifically, I believe it is a bug to have Firefox prompt the user as a result of any http status returned by XHR. The user has nothing to do with the XHR and may often be unaware that it is making requests. Prompting the user denies developers the opportunity to handle the status programmatically and may confuse inexperienced users.


Reproducible: Always

Steps to Reproduce:
1. Set a directory to HTTP Basic Authentication
2. Login to the directory
3. Use XHR.open("get",url,true/false,"badusername","baspassword") to log the user out.

Alternative:
1. Set a directory to HTTP Basic Authentication
2. Perform an unauthenticated XHR on that directory
Actual Results:  
The standard 401 dialog prompt appears to the user.

Expected Results:  
No response from Firefox.
XHR related javascript should receive  the XHR status and be allowed to handle it.

IE6 appropriately ignores HTTP header statuses returned by XHR. This prevent users from experiencing unexpected dialogs and browser responses to requests that they did not make specifically.

Comment 1

[fcp]

This bug is almost the same as bug 282547 and, as I explain below, the part of this bug that is different from 282547 should be rejected.  Therefore I mark this as duplicate.

In this bug it is argued that a browser should never prompt for credentials as a result of XHR.  This would imply, unlike 282547, that it should not prompt even if credentials are not provided in the call to open() of XHR.  However, that would be against what the current working draft states as a SHOULD:
http://www.w3.org/TR/2009/WD-XMLHttpRequest-20090820/#the-send-method
> If authentication fails, and request username and request password are both
> null, user agents SHOULD prompt the end user for credentials.
Therefore, it should be rejected.