Dragana Damjanovic [:dragana] Assignee
	Description • 7 years ago

We only need to change  pref.

	Dragana Damjanovic [:dragana] Assignee
	Comment 1 • 7 years ago

Chrome already have this as default(bug 647010 comment 87) so I do not expect that we will break something.

	Dragana Damjanovic [:dragana] Assignee
	Comment 3 • 7 years ago

https://treeherder.mozilla.org/#/jobs?repo=try&revision=4a10f8ec00782460b6a28a57dba36bae1ccca96a

	Christoph Kerschbaumer [:ckerschb]
	Comment 4 • 7 years ago

Do we need an intent-to-ship for this?

	Dragana Damjanovic [:dragana] Assignee
	Comment 5 • 7 years ago

(In reply to Christoph Kerschbaumer [:ckerschb] from comment #4)
> Do we need an intent-to-ship for this?

I will write one, although Chrome already implement this.

	Pulsebot
	Comment 6 • 7 years ago

Pushed by dd.mozilla@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1a59ea77d44f
Change a pref so that an auth prompt requested by an image resource loaded from cross-originis not allowed. r=ckerschb

	Kohei Yoshino [:kohei]
	Comment 7 • 7 years ago

Posted the site compatibility note: https://www.fxsitecompat.com/en-CA/docs/2017/http-auth-dialog-can-no-longer-be-triggered-by-cross-origin-images/

	Dorel Luca [:dluca]
	Comment 8 • 7 years ago
bugherder

https://hg.mozilla.org/mozilla-central/rev/1a59ea77d44f

	Chris Mills [:cmills]
	Comment 9 • 6 years ago

I've documented this on MDN:

* Added a note to the Fx59 rel notes:
https://developer.mozilla.org/en-US/Firefox/Releases/59#Security

* Added a small section to the HTTP authentication page:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#Authentication_of_cross-origin_images

Let me know if this is OK. Thanks!

	Dragana Damjanovic [:dragana] Assignee
	Comment 10 • 6 years ago

(In reply to Chris Mills (Mozilla, MDN editor) [:cmills] from comment #9)
> I've documented this on MDN:
> 
> * Added a note to the Fx59 rel notes:
> https://developer.mozilla.org/en-US/Firefox/Releases/59#Security
> 
> * Added a small section to the HTTP authentication page:
> https://developer.mozilla.org/en-US/docs/Web/HTTP/
> Authentication#Authentication_of_cross-origin_images
> 
> Let me know if this is OK. Thanks!

Looks good. Thanks.

	MustLive
	Comment 11 • 6 years ago

Hello!

This bug is just the same as my Bug 647010, which I informed Mozilla about in March 2011. This is vulnerability in all browsers, which support Basic/Digest Authentication, as I wrote in my entry. So a lot of web browsers are vulnerable, not only Firefox.

I called this attack as Onsite phishing (or Inline phishing). It can be used (including by phishers) for stealing of logins and passwords of users of web sites.