wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-07 00:08:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

Block http auth prompt for cross-origin image subresources by default.

Browse source 
Still allow this to be bypassed with a pref for those really rare corner
cases where images are loaded cross-origin by design and the session
hasn't been/can't be authenticated ahead of time.
This commit is contained in:
wolfbeast 2019-07-15 14:13:14 +02:00 • committed by Roy Tam
commit 8ad0b46284
3 changed files with 28 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

7
modules/libpref/init/all.js
View file

@ -1988,6 +1988,13 @@ pref("network.generic-ntlm-auth.workstation", "WORKSTATION");
// 2 - allow the cross-origin authentication as well.
pref("network.auth.subresource-http-auth-allow", 2);
// Sub-resources HTTP-authentication for cross-origin images:
// true - presenting the http auth. dialog for cross-origin images is allowed.
// false - suppress the http auth. dialog for cross-origin images.
// If network.auth.subresource-http-auth-allow has a value of 0 or 1, this pref
// does not have any effect.
pref("network.auth.subresource-http-img-XO-auth", false);
// This preference controls whether to allow sending default credentials (SSO) to
// NTLM/Negotiate servers allowed in the "trusted uri" list when navigating them
// in a Private Browsing window.