Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In an answer to Windows Authentication with Google Chrome it is indicated that Chrome does not yet support Auto NTLM Authentication which means that users authenticating to sites using Windows Authentication are prompted for a login. Which is annoying but not a problem. Where the problem resides is that the users password is then sent in clear text to the authenticating site.

I whipped up a quick ASP.NET script that pulls the password out of the AUTH_PASSWORD in Request.ServerVariables collection. Both Safari and Opera prompt for user credentials but neither sends the password in clear text in the HTTP header. I find this especially odd since Chrome like Safari is based on WebKit.

What is the difference between the way Chrome Authenticates in comparison to other browsers and why does it send the password to a site in this manner?

share|improve this question
up vote 1 down vote accepted

NTLM is currently being ported to Chrome. See this. Just wait for the next version.

share|improve this answer

One possibility is that chrome may not support NTLM at all, and Chrome simply falls back to HTTP BASIC authentication. Can you obtain the exact headers in use with wireshark or similar?

share|improve this answer
My experience with Wireshark is limited but I am guessing I won't be able to see the authentication because the site I am running against is using SSL. If there's a way around that let me know. I was thinking of just turning basic authentication off on the server and seeing if Chrome can still get there. – ahsteele Aug 5 '09 at 18:25

In reply to your comment on bdonlan's answer:

I am guessing I won't be able to see the authentication because the site I am running against is using SSL.

The burp proxy tool allows watching (and even modifying) HTTP requests and responses, and it can act as a HTTPS proxy too. (It may or may not work, depending on how Chrome uses HTTPS proxies.)

share|improve this answer

From what I can tell via Wireshark, Chrome does support NTLM authentication. What it does not support is single sign-on by passing through your existing credentials.

This is why the AUTH_PASSWORD field is empty.

share|improve this answer
So in some fashion Safari and Opera support single-sign-on which is why AUTH_PASSWORD is blank when authenticating with those browsers? – ahsteele Aug 5 '09 at 21:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .