88771 - URL bar menu (autocomplete) should hide URL passwords

Status: RESOLVED DUPLICATE of bug 146289

(SeaMonkey :: Location Bar, defect)

Description

[Brian 'netdragon' Bober]

Basically if you do this:

http://name:[e-mail]

or 

ftp://name:[e-mail]

it would be nice to put * - stars in place of the password in the url dropdown. 
It would be especially good for universities where many people share the same 
computer.

Comment 1

[[e-mail]]

I would like to see the password removed immediately from all entered URLs
(although that would require the password to be saved somewhere else).

Comment 2

[Aaron Kaluszka]

I think this should be a preference because I personally like the way it works now.

Comment 3

[Mitchell Stoltz (not reading bugmail)]

What is our current behavior WRT passwords in URLs? Should we be stripping them
out immediately after the initial load and not saving them in history, etc? Or
should we just star them out as Brian suggests?

Comment 4

[Brian 'netdragon' Bober]

I wouldn't like it if the user:password was removed from the url line when
placed in it. Currently, the user:password is left on the line. It would also be
confusing WRT to the dropdown box if it was stripped. You wouldn't know if it
was already set to login. Although, it might be bad security to even put it in
the dropdown box. Maybe the password should be totally left out when placed in
the dropdown box.

For instance:

http://blah:[e-mail]/
 
1) would turn into for the url box

http://[e-mail]

or 

http://blah:****@www.yahoo.com

2) and would turn into for the dropdown box

http://[e-mail]

I believe doing the first option would be the best for #1. It would keep
consistency.

As for in the history, it leaves the password intact too. 6/25 build.


<offtopic>
Btw: I can't get either FTP or http authentication to work using this method. In
fact, FTP doesn't work at all. Are these known issues?</offtopic>

 

Comment 5

[Doug Turner (:dougt)]

to alec.

Comment 6

[Alec Flett]

->URL Bar, still me.

Comment 7

[Alec Flett]

reassign url bar bugs to new owner..

Comment 8

[benc]

I haven't worked through all the RFCs, but the first convention is illegal anyhow.

Comment 9

[Blake Ross]

Joe was dying to have these bugs. Who am I to say no?

Comment 10

[Benjamin Mucci]

Should not be set to Future IMO. It's a critical security issue.

Comment 11

[Adam Hauner]

This is not enhancement, this is really security bug. Brian, could you set any
other target?

Comment 12

[Adam Hauner]

*** Bug 138463 has been marked as a duplicate of this bug. ***

Comment 13

[Brian 'netdragon' Bober]

Adding the mozilla1.0 keyword and changing the milestone to 1.0 to see if this
gets any support from drivers.

Comment 14

[Adam Hauner]

Brian: You can't change Target Milestone, it's Joe Hewitt's target. Setting back
-> Future.
(Joe: If I'm wrong, correct me)

Comment 15

[Boris Zbarsky [:bzbarsky]]

*** Bug 157354 has been marked as a duplicate of this bug. ***

Comment 16

[Nicholas Bebout ([e-mail] is my new email)]

I think that it should not save the passwords in history or in the url bar.

It is insecure for them to be saved like that.

Comment 17

[Nicholas Bebout ([e-mail] is my new email)]

Sorry for the spam...
Changing CC to my new email addy..

Comment 18

[Alon Altman]

If I'm not wrong, the patch for bug 130327 fixes this bug as well.

Comment 19

[Jo Hermans]

*** Bug 250337 has been marked as a duplicate of this bug. ***

Comment 20

[tevion48x]

I read and read and read but didn't find any solution for my problem which I
posted in bug number 279296.

Can someone please tell me how to teach Firefox 1.0 NOT to remove the username
and password from the URL?

Comment 21

[OstGote!]

*** Bug 288731 has been marked as a duplicate of this bug. ***

Comment 22

[Daniel Veditz [:dveditz]]

*** Bug 288449 has been marked as a duplicate of this bug. ***

Comment 23

[kstahl]

I don't like this behaviour at all. Seems like a big security risk to me. 

Requesting blocking 1.1.

Comment 25

[Philip Chee]

Forward dupping to Bug 146289 since there is a patch there.