Issue metadata
Sign in to add a comment
|
Security: http basic-auth modal displays before SSL status updates in the location bar
Reported by
demoss.m...@gmail.com,
Nov 19 2016
|
||||||||||||||||||||||||
Issue descriptionVULNERABILITY DETAILS It's really difficult for a user to tell whether everything is fine with TLS when visiting a page that caused a prompt for basic-auth over https. VERSION Chrome Version: 55.0.2883.52 beta (64-bit) (and other verions as well, anecdotally) Operating System: Win 10, 1151 (and others) REPRODUCTION CASE Visit a page using HTTPS that prompts for BASIC AUTH. Example: https://httpbin.org/basic-auth/user/passwd It's very difficult for a user to determine whether the site's certificate is valid judging from the UI. Is this a security issue? Only if you think anybody looks at that indicator! ;-) |
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by mea...@chromium.org
, Nov 21 2016Labels: -Restrict-View-SecurityTeam allpublic
Mergedinto: 395050
Status: Duplicate (was: Unconfirmed)