HTTP basic auth: wrong credentials sent when navigating between sibling URLs using different realms
Categories
(Core :: Networking: HTTP, defect, P3)
Tracking
()
People
(Reporter: pae9, Unassigned)
References
Details
(Whiteboard: [necko-backlog])
Comment 1•13 years ago
|
||
Comment 2•13 years ago
|
||
Reporter | ||
Comment 3•13 years ago
|
||
Updated•13 years ago
|
Comment 4•13 years ago
|
||
Updated•9 years ago
|
Comment 5•7 years ago
|
||
Comment 6•7 years ago
|
||
Comment 7•6 years ago
|
||
I just experienced this, or very similar.
Logged into a website I'm developing for using basic authentication,
/areaA, RealmA as userA
then into
/areaB, RealmB as userB
Navigated back to /AreaA, did some browsing, and site appeared to time-out. I though the server had gone down, but after some investigation and help from hosting company support, it turns out my IP address was blocked due to "too many failed logins". Couldn't work out what that meant, since I hadn't experienced a "failed login".
Looking at the Apache logs, though I can see that requests for files in /areaA are being made using the userB username, returning 401, and then getting immediately re-attempted with the userA username, whereupon they succeed. This seems to happen for every file access.
This is a serious bug; I had to have my IP whitelisted just so I could use the site without being immediately re-blocked.
I'm sure other users have had this happen, and not figured out why, or how to fix it.
Please fix!
Updated•2 years ago
|
Description
•