NEW 35390
behavior with http auth and xmlhttprequest 
https://bugs.webkit.org/show_bug.cgi?id=35390
Summary behavior with http auth and xmlhttprequest
Dan Winship
Reported 2010-02-25 09:13:43 PST
http://www.vsecurity.com/download/tools/fbha-poc_0.1.zip is a proof of concept of using xmlhttprequest to allow html form-based auth but using http auth underneath instead of cookies. On Firefox, IE, Safari, and Chrome, it uses http auth, but does not pop up any browser password dialog boxes. In Epiphany though, both the login and logout pages pop up a dialog. (To run the test server, download the zip file, unzip it, and just run the python script, giving it a port number.) Haven't looked in detail, but it seems like the difference might be that the other browsers never prompt for passwords on xmlhttprequest requests? (or at least, on xmlhttprequest requests that contain password arguments)
Attachments
Add attachment proposed patch, testcase, etc.
Alexey Proskuryakov
Comment 1 2010-07-12 15:35:19 PDT
> (or at least, on xmlhttprequest requests that contain password arguments) That would be bug 32916.
Alexey Proskuryakov
Comment 2 2010-07-12 15:36:06 PDT
See also: bug 8291.
Note You need to log in before you can comment on or make changes to this bug.