87331 - "Ask every time" for PIN is not enforced for tokens

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[Terry Hayes]

When user chooses "ask every time" for password settings, NSS is supposed to
prompt for each important use of key material.  It works for the built in token,
but is not enforced for "external" devices such as iButton.

To reproduce:
1) set the password prefs to "ask every time".
2) With a certificate installed on a token (such as iButton), connect to a site
the requires client authentication.  If the token requires login to look at the
certificates, you should get a password prompt.  In addition, when you perform
then client authentication, the password prompt should also appear.
3) Connect to another site that requires the certificate.  The password prompt
should appear again.  (The prompt to get access to certs should not appear in
this case)

Comment 1

[Terry Hayes]

Add cc, reassign to relyea.

Comment 2

[Terry Hayes]

Attachment: Patch to pk11slot.c (unverified)

Comment 3

[Wan-Teh Chang]

Bob, is this patch safe enough to go into NSS 3.3?

Comment 4

[Robert Relyea]

Yes.

It shouldn't effect servers at all anyway.

bob

Comment 5

[Robert Relyea]

Fix checked into the drunk (Not in NSS 3.3 or PSM).