Bug 41090 – Synchronous XMLHttpRequest retries incorrect credentials indefinitely

• Status: NEW
• Component: XML

[Stuart Ng]

Create XHR and open with username and password passed in.
Server replies with 401 and Basic Authentication Scheme
Instead of replying with Basic Authentication Scheme, NTLM Scheme was used and hence authentication always fails.

[Alexey Proskuryakov]

Could you please provide a test case? That's certainly the first time I hear about this problem - and we've got regression tests to verify that Basic auth works.

[Stuart Ng]

Created attachment 59574 [details]
PHP Script On Server to Simulate Basic Authentication

[Stuart Ng]

I basically host the attached PHP script on an IIS.

Then, I create an XHR request with the following:

xhr.open('GET', 'secure.php', false, 'user', 'password');
xhr.send();

What I see:

HTTP Get was sent without Authorization Header
HTTP Response from PHP with 401 and Basic Authentication
HTTP Get was sent again this time with Authorization, but using NTLM Authentication
HTTP Response Again with 401 but with NLMP Authentication

Basically the last two messages keep repeating until Network Error 101 was received on browser.

This is reproduced for both sync and async mode.

[Alexey Proskuryakov]

Thanks! Could you please also attach a wireshark <http://www.wireshark.org/> packet trace?

[Stuart Ng]

Created attachment 59585 [details]
Packet Trace from Microsoft Network Monitor

[Stuart Ng]

Added new attachement with Microsoft Network Monitor Trace from Safari.

This is the sync case, note the first HTTP 401 request Basic Authentication but than got respond in NTLM Authentication.

The HTTP 401 pings pongs until the end when Network Error 101 was received on browser.

[Alexey Proskuryakov]

> Added new attachement with Microsoft Network Monitor Trace from Safari.

This trace isn't very helpful, because it doesn't include actual requests or responses. Wireshark can save those.

[Stuart Ng]

Created attachment 59651 [details]
Actual Capture

[Stuart Ng]

I have attached the actual capture. You can download Microsoft Network MOnitor for free and open this file. Or you can use Wireshark.

It contains the actual packet dump hope it helps.

[Alexey Proskuryakov]

Here is what happens here:
1. The server responds with a list of supported authentication schemes:
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
WWW-Authenticate: Basic realm="My Realm"
2. Safari chooses Negotiate, since it's the first one.
3. Authorization fails, since it goes to IIS own Negotiate handler which rejects the credentials you supply.

It looks like a Safari bug that we retry with failed credentials indefinitely, I'm not yet sure if it's in WebKit or below. But the actual failure is a server side issue.

Could you please verify that this only happens with sync XHR?

[Stuart Ng]

Thanks! I turned off authentication processing on IIS for that particular folder, and everything works!