Keepassxc-browser: Autofill of HTTP Basic Auth for multiple specific files not working

[niklaswa]

Expected Behavior

1. Open web page
2. Web page loads some js files which are behind a basic auth
3. Plugin automatically fills in these credentials and proceeds loading whole page.

Current Behavior

Basic Auth Popup opens.

Possible Solution

Maybe try detecting certain files which are getting loaded instead of only the initial request?

Steps to Reproduce (for bugs)

It's an internal corporate webpage, so I unfortunately can't share the url here.

Debug info

KeePassXC - 2.4.3
KeePassXC-Browser - 1.6.3
Operating system: Win32
Browser: Chrome/Chromium 79.0.3945.79

[varjolintu]

So credentials for the same URL doesn't automatically work with that auth request?

[niklaswa]

I've one entry in keepass with the domain itself for the basic auth credentials.
I temporarily deactivated all other entries for that domain/subdomain/subpaths (like user accounts).
And I still can't get it to work.
When I open a webpage where the initial request is behind the basic auth (on the same domain, same credentials) it works fine.

[varjolintu]

The only way to get this to work would be to investigate every file request during the page load, and I'm not sure if that's something we want to do. Another thing is that it's unclear if this is even possible to do at file level.

[niklaswa]

If it's possible, maybe as an optional - default deactivated - option 🤔

[varjolintu]

We are already connected to the webRequest.onAuthRequired, and I'm not aware of any other API that deals with HTTP Basic Auth. I suggest you to debug the extension's background script httpauth.js and see if the file request is visible in the callback function. I would do it myself but I'm lacking an example site.

[niklaswa]

I've created a test page with a html file and a js file behind a basic auth: https://test.niklas.top/ (test:123)

But... it works. So I have to invastigate more, so apparently the fact that only the file is behind a basic auth is not actually the issue...

[niklaswa]

@varjolintu I've added 3 other js files with the same credentials. Now only the first popup will get autofilled. I think that could be the issue.

[varjolintu]

Thanks for the test site. I'll look into it.

[varjolintu]

Ok. I know what happens but I don't know why it happens.

Each file load sends a request for retrieving credentials from KeePassXC, but only first one of these is received. And the same reply for the first request is seen in all four, which of course causes the last three to ignore it because the reply doesn't match the request.

[niklaswa]

@varjolintu How's the roadmap of the plugin?
Is it worth it to get on the project and invest time to understand the architecture and look for myself or do you have any ideas how this could be fixed faster and easier by yourself?

[varjolintu]

I haven't had time to look this any further (yet) but here's some more information about my last attempts to solve this:

Things I tried:

• Removed any possible sleep or delay from the proxy when reading stdin. No help.
• Made a message buffer to the extension that ensures the replies are for the correct request (this could be merged anyway because it increases the reliability of passing messages). No help.
• Made sure that the four request differ and are sent separately. Confirmed.

Things that need to be tried:

• Trace the messages between extension (e.g. with strace) and the proxy to confirm the requests are received correctly. This way we can ensure if the problem is with the proxy, KeePassXC or Native Messaging.
• If the same happens with direct connection to KeePassXC. However, this feature will be removed in 2.6.0.

[varjolintu]

Changes made in 1.7.0 allowed me to solve this pretty quickly. Give the PR a try.

[niklaswa]

I imported the branch as a dev extension, allowed the origin and I tried it on my test page, so when I first open it, it asks me to allow access to the entry in KeePassXC, then it loads the first JS file and then it just keeps on loading.. :/

[varjolintu]

Hmmh? I need to retest it then. It worked for me last time.

[varjolintu]

Retested it, and it gets stuck after the first file when browsing the page first time. After that all files load normally, if you reload the page.