From 45cb5ab7291f44d3e06de4e71e5b0a9e80f6a0b6 Mon Sep 17 00:00:00 2001 From: wolfbeast Date: Mon, 15 Jul 2019 14:13:14 +0200 Subject: Block http auth prompt for cross-origin image subresources by default. Still allow this to be bypassed with a pref for those really rare corner cases where images are loaded cross-origin by design and the session hasn't been/can't be authenticated ahead of time. --- modules/libpref/init/all.js | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'modules/libpref') diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js index 1aec5f393..38c3ced91 100644 --- a/modules/libpref/init/all.js +++ b/modules/libpref/init/all.js @@ -1988,6 +1988,13 @@ pref("network.generic-ntlm-auth.workstation", "WORKSTATION"); // 2 - allow the cross-origin authentication as well. pref("network.auth.subresource-http-auth-allow", 2); +// Sub-resources HTTP-authentication for cross-origin images: +// true - presenting the http auth. dialog for cross-origin images is allowed. +// false - suppress the http auth. dialog for cross-origin images. +// If network.auth.subresource-http-auth-allow has a value of 0 or 1, this pref +// does not have any effect. +pref("network.auth.subresource-http-img-XO-auth", false); + // This preference controls whether to allow sending default credentials (SSO) to // NTLM/Negotiate servers allowed in the "trusted uri" list when navigating them // in a Private Browsing window. -- cgit v1.2.3