user.js

commit 5bd5f6b28e801b8437e2574fad35f52365a6b593
parent 55c2cacbce27003c77cf05069b964944ab65dde3
Author: Thorin-Oakenpants <Thorin-Oakenpants@users.noreply.github.com>
Date:   Tue, 18 Dec 2018 01:41:37 +1300

0912: HTTP Auth sub-resources #585 (#602)


Diffstat:
M
user.js
 | 
7
+++++++

1 file changed, 7 insertions(+), 0 deletions(-)
diff --git a/user.js b/user.js
@@ -645,6 +645,13 @@ user_pref("signon.formlessCapture.enabled", false);
  * [2] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1217152,1319119 ***/
 user_pref("signon.autofillForms.http", false);
 user_pref("security.insecure_field_warning.contextual.enabled", true);
+/* 0912: limit (or disable) HTTP authentication credentials dialogs triggered by sub-resources [FF41+]
+ * hardens against potential credentials phishing
+ * 0=don't allow sub-resources to open HTTP authentication credentials dialogs
+ * 1=don't allow cross-origin sub-resources to open HTTP authentication credentials dialogs
+ * 2=allow sub-resources to open HTTP authentication credentials dialogs (default)
+ * [1] https://www.fxsitecompat.com/en-CA/docs/2015/http-auth-dialog-can-no-longer-be-triggered-by-cross-origin-resources/ ***/
+user_pref("network.auth.subresource-http-auth-allow", 1);
 
 /*** [SECTION 1000]: CACHE / SESSION (RE)STORE / FAVICONS [SETUP-CHROME]
      ETAG [1] and other [2][3] cache tracking/fingerprinting techniques can be averted by