Authentication prompt displayed twice, even if authentication scheme doesn't expect login and password9only after NTLM authentication)
Reported by
tarasov....@gmail.com,
Feb 3 2017
|
|||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 Steps to reproduce the problem: 1. Open page which returns 401 status with "WWW-Authentication:Negotiate". Make sure that your PC is not part of domain (So, NTLM authentication will be used). 2. Browser prompts user for login and password. Enter any login/password. 3. Browser resend request again with "Authorization:Negotiate TlR...." header 4. Server checks, that it's NTLM authentication and NTLM isn't supported, so it's sends 401 WWW-Authenticate: <Some custom scheme, not Basic,Digest,Negotiate> 5. Chrome displayed authentication prompt again. If user enters any username/password - then request will be failed with "net::ERR_UNEXPECTED" What is the expected behavior? 5. Chrome doesn't show authentication prompt again and just return response (in case of XHR) What went wrong? Chrome must not show authentication prompt with login and password, if authentication scheme is unknown. You could use http://updates-vkd.rhcloud.com/index.html for test. It contains link to image, which requires authentication (there is no image itself, actually). Server for the image is configured in the following way: 1. If there is no Authorization header with NTLM - return 401 WWW-Authentication: Negotiate 2. If there is NTLM Authorization header - return 401 WWW-Authenticate: MyToken And in this case Chrome shows authentication prompt for login and password even for second challenge, when MyToken scheme is used. This is useless, since Chrome can't use login and password with unknown scheme. Did this work before? N/A Does this work in other browsers? Yes Chrome version: 55.0.2883.87 Channel: stable OS Version: 10.0 Flash Version: Shockwave Flash 24.0 r0 We have server, which supports only Kerberos and custom authentication. First, server attempt to use Negotiates. If server detects, that client sends NTLM handshake - it immediately sends 401 WWW-Authenticate: <custom scheme> Since there is no way to say to browser, that we don't want fallback to NTLM, then clients which supports only NTLM is asked for login/password twice - first time for Negotiate (we would like to ignore thiw prompt, but it seems, that it isn't possible), and second time for our custom authentication scheme. We could live with one authentication prompt (we show custom authentication form in that case like "Sorry, your browser doesn't support Kerberos, please use this form" But it's very weird if useless authentication prompt is appeared twice.
,
Feb 6 2017
,
Feb 10 2017
Adding 'TE-NeedsTriageHelp' label to the issue as it is out of scope from TE end to triage the issue.Requesting dev team for further investigation. Thanks.
,
Jun 1 2017
Yeah, this is likely because the challenge wasn't cleared after seeing an unrecognized auth challenge.
,
May 2 2018
Going to go ahead and archive this - it's something that would probably be fixed as part of a major auth refactor (Which the code could really use). |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ajha@chromium.org
, Feb 6 2017