newhinton
commented
4 years ago @robin-thoni this can be promising!
However, http-auth is quiet a sensible topic (since auto-sending authheader is quiet a bad idea since anybody can grab your credentials this way) so this needs to be save. Currently you ask for credentials (which is great, maybe we can enhance this with some custom ui but i doubt so), but sending credentials without confirmation is not good and we should improve that.
I will assist you if you need/want help, because i think this will be a great addition to this extension. Keep up your good work! :D
This is not intended to be merged as-is. It's a proof of concept that would require more work to be fully functional.
This change allows to ask the user to confirm whether or not to send credentials for an HTTP authentication. It currently only allows user to say yes or no to one credential. A more advanced scenario would be to present the full list of credentials that match the request, and ask user to select one. Problem with this is that the page is changing, and HTML modification seem to be blocked (tested on Chrome 75). Moreover, the same limitation as below would still apply. A small native app on user OS running a lite HTTP server and a very basic UI could be a workaround to this restriction.
Known issues:
confirm()in the current page context. However, it is not possible to do so on the new tab page, nor on an error page. In such a case, the old behavior (sending credentials without any confirmation) will occur.