[tbb-commits] [tor-browser/tor-browser-24.7.0esr-4.x-2] Bug #12974: Disable NTLM and Negotiate HTTP Auth

[mikeperry at torproject.org]

commit 4825026471678728d5aa085717e301fc6551fe2b
Author: Mike Perry <mikeperry-git at torproject.org>
Date:   Wed Aug 27 15:19:10 2014 -0700

    Bug #12974: Disable NTLM and Negotiate HTTP Auth
    
    This is technically an embargoed Mozilla bug, so I probably shouldn't provide
    too many details.
    
    Suffice to say that NTLM and Negotiate auth are bad for Tor users, and I doubt
    very many (or any of them) actually need it.
    
    The Mozilla bug is https://bugzilla.mozilla.org/show_bug.cgi?id=1046421
---
 extensions/auth/nsHttpNegotiateAuth.cpp  |    4 ++++
 netwerk/protocol/http/nsHttpNTLMAuth.cpp |    3 +++
 2 files changed, 7 insertions(+)

diff --git a/extensions/auth/nsHttpNegotiateAuth.cpp b/extensions/auth/nsHttpNegotiateAuth.cpp
index 5248730..3e5580d 100644
--- a/extensions/auth/nsHttpNegotiateAuth.cpp
+++ b/extensions/auth/nsHttpNegotiateAuth.cpp
@@ -85,6 +85,10 @@ nsHttpNegotiateAuth::ChallengeReceived(nsIHttpAuthenticableChannel *authChannel,
     nsIAuthModule *module = (nsIAuthModule *) *continuationState;
 
     *identityInvalid = false;
+
+    /* Always fail Negotiate auth for Tor Browser. We don't need it. */
+    return NS_ERROR_ABORT;
+
     if (module)
         return NS_OK;
 
diff --git a/netwerk/protocol/http/nsHttpNTLMAuth.cpp b/netwerk/protocol/http/nsHttpNTLMAuth.cpp
index d25c1de..6882803 100644
--- a/netwerk/protocol/http/nsHttpNTLMAuth.cpp
+++ b/netwerk/protocol/http/nsHttpNTLMAuth.cpp
@@ -239,6 +239,9 @@ nsHttpNTLMAuth::ChallengeReceived(nsIHttpAuthenticableChannel *channel,
 
     *identityInvalid = false;
 
+    /* Always fail Negotiate auth for Tor Browser. We don't need it. */
+    return NS_ERROR_ABORT;
+
     // Start a new auth sequence if the challenge is exactly "NTLM".
     // If native NTLM auth apis are available and enabled through prefs,
     // try to use them.