Does hosting an http->https redirect let http basic auth leak?

Question

I was just pondering how http basic auth is sent with every request, I often wish to use http-to-https redirects when possible for the nicer user experience (Have we gotten to the place of browsers trying https by default without htst yet?); though it was occuring to me that if a particular resource were using http basic auth, and also had a an http port open- it isn't unthinkable that http basic auth credentials might be sent there as happens with humans handle security measures with their usual level of grace.

I would love to be told "no, no reasonable browser, tool or software developer would submit basic auth over bare http anymore" and that prevention was baked in as to require undue effort to bypass. but I'm thinking http basic auth resources should just not have port 80 httpd's available to humans whatsoever.

Answer 1

This is likely browser-dependent as it is related to a password manager component which is not standardized. It is also 3rd party software dependent as some password managers are provided by 3rd parties.

I have tested it on Firefox 52 ESR using a built-in password manager, and it uses schema as part of the authentication query. Thus if you stored credentials using https:// scheme, they will not be submitted with http:// schema - and vice versa.

Chromium 63 has exactly the same behavior.

Note that it depends on scheme, not port - you can have https://yourdomain:80 or http://yourdomain:443