6

On one of my web servers, I have set up a password-protected directory using the well-known .htaccess / .htpasswd mechanism. The web server is run by Apache 2.4.10 under Debian jessie, if that matters. The relevant snippet from the virtual host configuration:

<Directory "/home/www/path/to/protected/directory">
  AuthType Basic
  AuthName "Restricted Content"
  AuthUserFile /etc/apache2/.htpasswd
  Require valid-user
</Directory>

Now, when I open a document from that protected area using Firefox, Firefox asks for the credentials. So far, so good.

But when I clear Firefox's login data and cache, using Tools -> Options -> Privacy & Security -> Clear Data -> Clear (with both items in the dialog being checked), and then re-open the same or any other document from that protected area, Firefox shows that document without asking for the credentials again.

In other words, Firefox either does not delete its cache when being instructed to do so, or it does not delete what it calls "Site Data" when being instructed to do so.

If I am right, this is a serious security breach. A reasonable user knows that (when not using his own private device, e.g. when using a PC in an internet cafe) the browser's cache and login data should be cleared after having used the browser to access password-protected areas, and relies that this works.

The only way to make Firefox forget such logins seems to be to first clear the cache and the Cookies and Site Data as described above and then immediately close the application (File -> Exit).

But this is not a real solution to the problem. If I instruct a browser to clear the Cache and the Cookies and Site data, I expect that it immediately forgets all credentials without restarting. Period.

I have tested this with Firefox 61.0.2 (the most recent version at the time of this writing) under Windows 7.

By the way, Chrome does it right.

Finally, to avoid misunderstandings:

The above only relates to credentials for the areas which are protected by .htaccess, i.e. where the browser itself asks for the credentials. All sites which implement access control by session cookies are not affected by the problem, because (as far as I can tell) Firefox indeed deletes all cookies as soon as you make it delete its data as described above.

What do you think about this? Is it a security problem?

1
  • Your question reminds me of when I'd try to clear Firefox browser history but kept leaving the "preserve favorites website data checkbox" thus it would delete everything except my most commonly used items. Commented Jun 5, 2019 at 4:25

3 Answers 3

8

Firefox (Firefox 68.0, under Linux) doesn't store this info in Cookies and Site Data but in History.

You need to go to Preferences->Privacy & Security and under the History section, click on Clear History.... Make sure the Active Logins checkbox is checked before you submit.

1
  • Thanks for the answer, and +1. Didn't try yet, but I believe you. So Mozilla considers the passwords as part of history rather than as part of site data. Very logical ... especially given that clearing the site data (including cookies which store session keys) normally logs you out of every site. So the user has to clear both the site data (cookies) and the history to log out safely from everything. Great.
    – Binarus
    Commented Aug 6, 2019 at 16:13
4

The accepted answer (clearing "Active Logins" from "Clear History...") has the disadvantage that it clears all active logins, including from other sites on other browser tabs.

An alternative, at least with Firefox, is to reload the page by specifying a different (or invalid) login. This can be done by adding it in front of the URL:

http://[email protected]/...

This can also be used to login as a different user this way:

http://other-user:[email protected]/...

While such URL's have been deprecated in RFC 3986 for security reasons, they still work in Firefox v. 80. So it's still a viable workaround until browsers implement better authentication management.

2
  • It doesn't reset cache, just updates it to a new username. And password doesn't work on a modern Firefox
    – nikicat
    Commented Mar 24, 2023 at 16:50
  • Thanks for the answer, and +1. However, no normal user with average knowledge would come to that idea when leaving a public PC and trying to clear the passwords. However, maybe the problem does not exist any more in the meantime. It's 2023 now, and I didn't test again since asking.
    – Binarus
    Commented Jun 16, 2023 at 10:13
1

You can remove login information, including the httpswd authentication requested by Apache, from any single site you want, without having to delete the entire history or login information from all sites:

Firefox
Burger icon (Options) at the top right under "X" / "Preferences" / "Privacy & Security" / "Logins and Passwords" section / "Saved logins" button / Select from the list the page from which you want to delete login data -> Press the "Delete" button at the top right

(i) A similar question is here: How do I make Firefox forget HTTP Basic Auth?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .