4

Where do browsers store HTTP Authentication credentials ? If I gain access to a browser, is there some place I can look where all HTTP Authentication details would be available? In most browsers, even after clearing all history, the credentials are not cleared. Only on closing the browser are these credentials cleared. Is there a valid usability reason behind not deleting them? Isn't this a security flaw from the browser's perspective ?

2

Interesting questions indeed, but the answer will vary depending on the design, implementation, and protocols the browser you're talking about was built in compliance with.

Let's take some real examples of Google Chrome:

  • Chrome stores login credential data-base under C:\Users\<username>\Appdata\Local\Google\Chrome\User Data\Default\Web Data
  • It also stores several sensitive user data under C:\Users\<username>\Appdata\Local\Google\Chrome\User Data\Default
  • Read more about Chrome Security issues here.

For other browsers this can also be true. Example: Extracting sessions passwords from RAM (aka: Memory forensics). There are many tools to help you with that.

Some people may argue that this is not a serious security issue, because it is assumed that you protect your user account and the operating system that hosts your browser.

  • thanks for the reply .. it sure has some useful info .. but I couldn't find the HTTP authentication details in these places though they do have the saved passwords.. – Eels Jun 27 '14 at 22:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.