[tor-bugs] #8335 [TorBrowserButton]: Torbutton 1.5 Causing Repeated HTTP Auth Prompts for Every Page

[Tor Bug Tracker & Wiki]

#8335: Torbutton 1.5 Causing Repeated HTTP Auth Prompts for Every Page
----------------------------------------------------------+-----------------
 Reporter:  tas142                                        |          Owner:  mikeperry                    
     Type:  defect                                        |         Status:  new                          
 Priority:  normal                                        |      Milestone:  TorBrowserBundle 2.3.x-stable
Component:  TorBrowserButton                              |        Version:                               
 Keywords:  tbb-rebase-regression, tbb-usability-website  |         Parent:                               
   Points:                                                |   Actualpoints:                               
----------------------------------------------------------+-----------------

Comment(by tas142):

 Replying to [comment:3 mikeperry]:
 > Hrmm. I wonder if this is due to our recent use of Private Browsing
 Mode.. This doesn't happen for me on trac.torproject.org, which uses HTTP
 auth + cookies. I suppose it could be because the cookies are surviving,
 which is enough for Trac.

 Right, it doesn't happen on trac.project.org because the HTTP auth seems
 to be on a subdirectory. The error only seems to occur when the HTTP auth
 is on the root directory of the website (ie, on the "public_html"
 directory).

 Strangely, if the root HTTP auth is disabled, subdirectories that have
 separate HTTP auth work as expected. Once a user enters a subdirectory and
 has been successfully authenticated, if the root HTTP auth is re-enabled,
 then the browser behaves as expected and after the initial prompt, HTTP
 auth of the root directory is preserved. However, once the browser is
 closed, on relaunch the issue reappears, and the user receives a prompt
 for each page the user visits.

 Tried disabling Private Browsing Mode and disabling all of TorButton's
 security settings, but the issue still persists, always with the following
 message after a page has loaded:

 Torbutton NOTE: Removing 3rd party HTTP auth for url: [scrubbed]

 Thanks for reviewing.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/8335#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online