4 ms·
I love Firefox, but I hate to see that they seem to have given in to the Chrome hegemony once again and hide the login realm message when doing HTTP basic authe
by TonyTrapp 5y ago
I love Firefox, but I hate to see that they seem to have given in to the Chrome hegemony once again and hide the login realm message when doing HTTP basic authentication now. I still hate Chrome to this day for starting to do that, because you can no longer send people to a site protected by basic auth and expect them to know which credentials to fill in. Firefox was the last popular browsing allowing the user to read the login message provided by the server.
- pxc 5y agoWhat's the rationale for hiding it?
- TonyTrapp 5y agoI don't know the true rationale, but if I remember correctly a Chrome dev provided some really dubious reasoning one the related issue tracker item, something like "someone could MITM the connection and change the basic auth message to 'please enter your YouTube credentials'". Well guess what, if I MITM your connection, I can provide a much more convincing HTML representation of the YouTube login page! I guess the grain of truth that was in there is that this is one of the few times where a server-provided string is presented as part of the browser's UI, but I am sure there are better ways to highlight that the browser is just quoting the server than outright not showing the message. Edit: It seems like a dubious security report was the origin of this, not a developer: https://bugs.chromium.org/p/chromium/issues/detail?id=544244 https://bugs.chromium.org/p/chromium/issues/detail?id=544244
- deleted 5y ago[deleted]