1

In an answer to Windows Authentication with Google Chrome it is indicated that Chrome does not yet support Auto NTLM Authentication which means that users authenticating to sites using Windows Authentication are prompted for a login. Which is annoying but not a problem. Where the problem resides is that the users password is then sent in clear text to the authenticating site.

I whipped up a quick ASP.NET script that pulls the password out of the AUTH_PASSWORD in Request.ServerVariables collection. Both Safari and Opera prompt for user credentials but neither sends the password in clear text in the HTTP header. I find this especially odd since Chrome like Safari is based on WebKit.

What is the difference between the way Chrome Authenticates in comparison to other browsers and why does it send the password to a site in this manner?

1

NTLM is currently being ported to Chrome. See this. Just wait for the next version.

0

One possibility is that chrome may not support NTLM at all, and Chrome simply falls back to HTTP BASIC authentication. Can you obtain the exact headers in use with wireshark or similar?

  • My experience with Wireshark is limited but I am guessing I won't be able to see the authentication because the site I am running against is using SSL. If there's a way around that let me know. I was thinking of just turning basic authentication off on the server and seeing if Chrome can still get there. – ahsteele Aug 5 '09 at 18:25
0

In reply to your comment on bdonlan's answer:

I am guessing I won't be able to see the authentication because the site I am running against is using SSL.

The burp proxy tool allows watching (and even modifying) HTTP requests and responses, and it can act as a HTTPS proxy too. (It may or may not work, depending on how Chrome uses HTTPS proxies.)

0

From what I can tell via Wireshark, Chrome does support NTLM authentication. What it does not support is single sign-on by passing through your existing credentials.

This is why the AUTH_PASSWORD field is empty.

  • So in some fashion Safari and Opera support single-sign-on which is why AUTH_PASSWORD is blank when authenticating with those browsers? – ahsteele Aug 5 '09 at 21:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.