search

w3c / webextensions

Charter and administrivia for the WebExtensions Community Group (WECG)
Other
592 stars 54 forks source link

Proposal: Support `PrivateToken` authentication scheme on `webRequest.onAuthRequired` #662

Open thibmeu opened 1 month ago

thibmeu commented 1 month ago

Background

webRequest.onAuthRequired is fired upon an authentication failure. Firefox defines this event as a response from the server with status code 401 or 407. This means the origin server asks for credentials. Chrome has similar requirements.

IETF recently published RFC 9577 defining PrivateToken authentication scheme. In this scheme, a server may request clients (browser) to provide a credential in the form of a PrivateToken. This seems well suited for webRequest.onAuthRequired, as it might require interaction from the end user, or storage access.

// In Chrome: use chrome. instead of browser.
browser.webRequest.onAuthRequired.addListener(
  function (details) {
    return { /* BlockingResponse here*/ };
  },
  { urls: ["*://example.com/*"] },
  ["blocking"]
);

Proposal

Update webRequest.onAuthRequired to support PrivateToken authentication scheme:

Rob--W commented 1 month ago

@thibmeu Could you offer a brief overview of the background and the request here, as well as the suggested shape of the API? It'd be easier to follow the discussion if every participant in the discussion is aware of the relevant context.

Here is my summary, please correct me or add more details as necessary:

Cloudflare is developing an extension (Silk) that implements a challenge-response based HTTP scheme. While Manifest Version 2 extensions could detect the header values with webRequest.onHeadersReceived, only Firefox supports async response handling. Chrome supported synchronous response handling in Manifest Version 2, but dropped that from Manifest Version 3, with the only webRequest.onAuthRequired being capable of reacting asynchronously to responses. Coincidentally the requested capability fits naturally in the onAuthRequired API, so there is a request here to detect 401 WWW-Authenticate PrivateToken responses and suspend the response handling until the extension has responded to it through the webRequest.onAuthRequired API.

Additional reading: