Open Bug 799930 Opened 12 years ago Updated 2 years ago

Firefox sends Kerberos TGTs over plain HTTP

Categories

(Core :: Networking: HTTP, defect, P3)

Product:
Core
Component:
Networking: HTTP
Platform:
x86_64
Linux
Type:
defect

Tracking

()

People

(Reporter: jhorak, Unassigned)

Details

(Whiteboard: [necko-backlog][ntlm])

From: https://bugzilla.redhat.com/show_bug.cgi?id=863106 Description of problem: When configuring Firefox for Kerberos authentication in some (rare) cases one needs to set network.negotiate-auth.delegation-uris to allow sending the Kerberos TGT to the server. However, it seems that values like https://*.example.com don't work so if a user is using a server which for some reason doesn't require SSL then the TGT will be sent over plain HTTP. It should be possible to limit TGT transfer over HTTPS only with wildcards like https://*.example.com.
Component: General → Networking: HTTP
Product: Firefox → Core
What do you think of it guys? I can do that, but not sure if it is wanted.
Whiteboard: [necko-backlog][ntlm]
Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258
Priority: -- → P1
Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258
Priority: P1 → P3
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.