Update Basilisk FE code with HTTP Auth DoS protection.

application/basilisk/app/profile/basilisk.js

@@ -1438,3 +1438,11 @@ pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false);
 // controlling validation are located in /services/sync/services-sync.js
 pref("services.sync.validation.enabled", true);
 #endif
+
+// When a user cancels this number of authentication dialogs coming from
+// a single web page (eTLD+1) in a row, all following authentication dialogs
+// will be blocked (automatically canceled) for that page.
+// This counter is per-tab and per-domain to minimize false positives.
+// The counter resets when the page is reloaded from the UI
+// (content-reloads do NOT clear this to mitigate reloading tricks).
+pref("prompts.authentication_dialog_abuse_limit", 3);

application/basilisk/base/content/browser.js

@@ -3099,6 +3099,11 @@ function getWebNavigation()
 }
 
 function BrowserReloadWithFlags(reloadFlags) {
+
+  // Reset DOS mitigation for auth prompts when user initiates a reload.
+  let browser = gBrowser.selectedBrowser;
+  delete browser.authPromptCounter;
+
   let url = gBrowser.currentURI.spec;
   if (gBrowser.updateBrowserRemotenessByURL(gBrowser.selectedBrowser, url)) {
     // If the remoteness has changed, the new browser doesn't have any

application/basilisk/base/content/tabbrowser.xml

@@ -3007,7 +3007,10 @@
         <parameter name="aTab"/>
         <body>
           <![CDATA[
-            this.getBrowserForTab(aTab).reload();
+            let browser = this.getBrowserForTab(aTab);
+            // Reset DOS mitigation for basic auth prompt
+            delete browser.authPromptCounter;
+            browser.reload();
           ]]>
         </body>
       </method>

application/basilisk/base/content/urlbarBindings.xml

@@ -554,6 +554,9 @@ file, You can obtain one at http://mozilla.org/MPL/2.0/.
             Cu.reportError(ex);
           }
 
+          // Reset DOS mitigations for the basic auth prompt.
+          delete browser.authPromptCounter;
+
           let params = {
             postData,
             allowThirdPartyFixup: true,