summaryrefslogtreecommitdiffstats
path: root/modules/libpref
diff options
context:
space:
mode:
authorwolfbeast <mcwerewolf@wolfbeast.com>2019-07-15 14:13:14 +0200
committerwolfbeast <mcwerewolf@wolfbeast.com>2019-07-15 14:13:14 +0200
commit45cb5ab7291f44d3e06de4e71e5b0a9e80f6a0b6 (patch)
tree9430091e5deb3f29a9a2ec262964e4d249687faf /modules/libpref
parent4491ec5eacd5ed501737c0db2c134fe1815c50a8 (diff)
downloadUXP-45cb5ab7291f44d3e06de4e71e5b0a9e80f6a0b6.tar
UXP-45cb5ab7291f44d3e06de4e71e5b0a9e80f6a0b6.tar.gz
UXP-45cb5ab7291f44d3e06de4e71e5b0a9e80f6a0b6.tar.lz
UXP-45cb5ab7291f44d3e06de4e71e5b0a9e80f6a0b6.tar.xz
UXP-45cb5ab7291f44d3e06de4e71e5b0a9e80f6a0b6.zip
Block http auth prompt for cross-origin image subresources by default.
Still allow this to be bypassed with a pref for those really rare corner cases where images are loaded cross-origin by design and the session hasn't been/can't be authenticated ahead of time.
Diffstat (limited to 'modules/libpref')
-rw-r--r--modules/libpref/init/all.js7
1 files changed, 7 insertions, 0 deletions
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index 1aec5f393..38c3ced91 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -1988,6 +1988,13 @@ pref("network.generic-ntlm-auth.workstation", "WORKSTATION");
// 2 - allow the cross-origin authentication as well.
pref("network.auth.subresource-http-auth-allow", 2);
+// Sub-resources HTTP-authentication for cross-origin images:
+// true - presenting the http auth. dialog for cross-origin images is allowed.
+// false - suppress the http auth. dialog for cross-origin images.
+// If network.auth.subresource-http-auth-allow has a value of 0 or 1, this pref
+// does not have any effect.
+pref("network.auth.subresource-http-img-XO-auth", false);
+
// This preference controls whether to allow sending default credentials (SSO) to
// NTLM/Negotiate servers allowed in the "trusted uri" list when navigating them
// in a Private Browsing window.