902452 - NTLM is not automatically renegotiated in new connections

Status: RESOLVED DUPLICATE of bug 1311720

(Core :: Networking, defect)

Description

[Jozsef Fejes]

There is a (private, under development) website that allows you to log in with NTLM (there is a login page that requires authentication), but the content pages do not require authentication. The page behaves differently based on who you are.

Let's say you go to the login page, enter your credentials and then view some content pages. The problem is that sometimes you seem to be authenticated, sometimes not. It seems that when the request goes through a (randomly chosen, kept alive) connection that was previously authenticated, then the new request is also authenticated. But when it is served in a new connection, it is not authenticated.

Most of the time you don't notice this behavior because most websites where NTLM is allowed it is also required. The browser is forced to reauthenticate every connection and it does so just fine. The problem happens when it is not forced to do so, then it does not authenticate itself, and it leads to random behavior.

If I reset all network connections and go to the landing page that requires authentication, Firefox does so automatically, without asking for my credentials again. So the credentials are cached in Firefox as expected, so the only problem is that they are not used automatically to reauthenticate new connections to the same website.