This site will have limited functionality while we undergo maintenance to improve your experience. If an article doesn't solve your issue and you want to ask a question, we have our support community waiting to help you at @FirefoxSupport on Twitter and/r/firefox on Reddit.

Avatar for Username

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

This thread was archived. Please ask a new question if you need help.

Firefox sends credentials in HTTP header to Apache2 for any subdirectory

  • 1 reply
  • 1 has this problem
  • 4 views
  • Last reply by cor-el

markus.mozilla
markus.mozilla
more options

Hello,

on an Apache 2.2 httpd I have configured a named virtual host like https://example.com:4711

This virtual host contains 2 reverse proxies for the /i/ and /apex/ subdirectories used for Oracle Application Express. In addition to this there is a subdirectory named /docs for some static documents which are independent from Oracle APEX.

Within the Apache virtual host configuration the /docs directory is password-protected using the directives "AuthType Basic" and "AuthName MyDir" inside a <Directory ...> section - this is working fine so far.

However, when being authenticated for the /docs directory, the credentials are also sent when requesting /apex/ or /i/ URLS - thus disturbing the Oracle APEX Authentication (which uses cookies). Doing some monitoring with Wireshark (after switching off SSL temporarily) shows that the credentials for the "MyDir" realm are sent in the HTTP header not only for /docs but just for every directory. After clearing the "Active Logins" the APEX login works fine again.

Tested with FF 60 ESR (as well as with old FF 45.9 ESR).

Is there any means to prevent this behaviour, i.e. that users do not have to clear "Active Logins"? Any help will be greatly appreciated.

Thanks in advance, Markus

Hello, on an Apache 2.2 httpd I have configured a named virtual host like https://example.com:4711 This virtual host contains 2 reverse proxies for the /i/ and /apex/ subdirectories used for Oracle Application Express. In addition to this there is a subdirectory named /docs for some static documents which are independent from Oracle APEX. Within the Apache virtual host configuration the /docs directory is password-protected using the directives "AuthType Basic" and "AuthName MyDir" inside a <Directory ...> section - this is working fine so far. However, when being authenticated for the /docs directory, the credentials are also sent when requesting /apex/ or /i/ URLS - thus disturbing the Oracle APEX Authentication (which uses cookies). Doing some monitoring with Wireshark (after switching off SSL temporarily) shows that the credentials for the "MyDir" realm are sent in the HTTP header not only for /docs but just for every directory. After clearing the "Active Logins" the APEX login works fine again. Tested with FF 60 ESR (as well as with old FF 45.9 ESR). Is there any means to prevent this behaviour, i.e. that users do not have to clear "Active Logins"? Any help will be greatly appreciated. Thanks in advance, Markus

All Replies (1)

cor-el
cor-el
  • Moderator
  • Top 10 Contributor
more options

Maybe create a bug report to get some feedback from the Firefox devs.