Bug 42717 – A wrong password entered for site or proxy auth remains in WebCore credential storage, and is sent with subsequent requests

• Component: Page Loading
• Status: RESOLVED FIXED

[Alexey Proskuryakov]

Credentials are never removed from WebCore credential storage, which has at least two downsides:
- if the remembered credentials are wrong, they will be sent with future requests, doubling server-side incorrect login counts;
- implementing logout by returning 401 in a response to valid credentials doesn't work. Note that this is not the best way to log out though, since an auth dialog will appear, which the user will have to cancel.

<rdar://problem/7062824>

[Alexey Proskuryakov]

Created attachment 62134 [details]
proposed fix

[Darin Adler]

Comment on attachment 62134 [details]
proposed fix

Is there a race in the “storing a new credential” case was well as in the removal case? I ask because your comment in removal seemed to offer no reason this was specific to removal.

[Alexey Proskuryakov]

The credentials are stored when they become known (and re-stored as default for directory when used). If a race condition happens there, it's really a bug in Web site code, we can do nothing to fix it.

In contrast, we could store ResourceHandle "current credential" to make sure that we're not removing a different one.

[WebKit Review Bot]

http://trac.webkit.org/changeset/63834 might have broken GTK Linux 32-bit Release

[Alexey Proskuryakov]

Yes, committed in <http://trac.webkit.org/changeset/63834> with follow up fixes in <http://trac.webkit.org/changeset/63836>.