Where do browsers store HTTP Authentication credentials ? If I gain access to a browser, is there some place I can look where all HTTP Authentication details would be available? In most browsers, even after clearing all history, the credentials are not cleared. Only on closing the browser are these credentials cleared. Is there a valid usability reason behind not deleting them? Isn't this a security flaw from the browser's perspective ?
Interesting questions indeed, but the answer will vary depending on the design, implementation, and protocols the browser you're talking about was built in compliance with.
Let's take some real examples of Google Chrome:
- Chrome stores login credential data-base under
C:\Users\<username>\Appdata\Local\Google\Chrome\User Data\Default\Web Data
- It also stores several sensitive user data under
- Read more about Chrome Security issues here.
Some people may argue that this is not a serious security issue, because it is assumed that you protect your user account and the operating system that hosts your browser.