New issue
Advanced search Search tips

Issue 688476 link

Starred by 3 users

Issue metadata

Status: Archived
Owner: ----
Closed: May 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug



Sign in to add a comment

Authentication prompt displayed twice, even if authentication scheme doesn't expect login and password9only after NTLM authentication)

Reported by tarasov....@gmail.com, Feb 3 2017

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36

Steps to reproduce the problem:
1. Open page which returns 401 status with "WWW-Authentication:Negotiate". Make sure that your PC is not part of domain (So, NTLM authentication will be used).
2. Browser prompts user for login and password. Enter any login/password.
3. Browser resend request again with "Authorization:Negotiate TlR...." header
4. Server checks, that it's NTLM authentication and NTLM isn't supported, so it's sends 401 WWW-Authenticate: <Some custom scheme, not Basic,Digest,Negotiate>
5. Chrome displayed authentication prompt again. If user enters any username/password - then request will be failed with "net::ERR_UNEXPECTED"

What is the expected behavior?
5. Chrome doesn't show authentication prompt again and just return response (in case of XHR)

What went wrong?
Chrome must not show authentication prompt with login and password, if authentication scheme is unknown. 

You could use http://updates-vkd.rhcloud.com/index.html
for test. 
It contains link to image, which requires authentication (there is no image itself, actually). 
Server for the image is configured in the following way:
1. If there is no Authorization header with NTLM - return 401 WWW-Authentication: Negotiate
2. If there is NTLM Authorization header - return 401 WWW-Authenticate: MyToken
And in this case Chrome shows authentication prompt for login and password even for second challenge, when MyToken scheme is used. This is useless, since Chrome can't use login and password with unknown scheme.

Did this work before? N/A 

Does this work in other browsers? Yes

Chrome version: 55.0.2883.87  Channel: stable
OS Version: 10.0
Flash Version: Shockwave Flash 24.0 r0

We have server, which supports only Kerberos and custom authentication. First, server attempt to use Negotiates. If server detects, that client sends NTLM handshake - it immediately sends 401 WWW-Authenticate: <custom scheme>
Since there is no way to say to browser, that we don't want fallback to NTLM, then clients which supports only NTLM is asked for login/password twice - first time for Negotiate (we would like to ignore thiw prompt, but it seems, that it isn't possible), and second time for our custom authentication scheme. 
We could live with one authentication prompt (we show custom authentication form in that case like "Sorry, your browser doesn't support Kerberos, please use this form"
But it's very weird if useless authentication prompt is appeared twice.

 

Comment 1 by ajha@chromium.org, Feb 6 2017

Labels: Needs-Milestone
Components: Internals>Network>Auth
Labels: TE-NeedsTriageHelp
Adding 'TE-NeedsTriageHelp' label to the issue as it is out of scope from TE end to triage the issue.Requesting dev team for further investigation.

Thanks.

Status: Available (was: Unconfirmed)
Yeah, this is likely because the challenge wasn't cleared after seeing an unrecognized auth challenge.
Status: Archived (was: Available)
Going to go ahead and archive this - it's something that would probably be fixed as part of a major auth refactor (Which the code could really use).

Sign in to add a comment