Re-enable embedded identities in URLs for HTTP authentication.

net/http/http_auth_controller.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_auth_controller.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/metrics/histogram.h"
 #include "base/string_util.h"
@@ skipping 432 matching lines @@
   // since the entry in the cache may be newer than what we used last time.
   http_auth_cache_->Remove(auth_origin_, handler_->realm(),
                            handler_->auth_scheme(), identity_.credentials);
 }
 
 bool HttpAuthController::SelectNextAuthIdentityToTry() {
   DCHECK(CalledOnValidThread());
   DCHECK(handler_.get());
   DCHECK(identity_.invalid);
 
-  // Do not try to use the username:password encoded into the URL.  At worst,
-  // this represents a session fixation attack against basic auth, and as it
-  // turns out, IE hasn't supported this for years. If a caller really wants
-  // to use embedded identities, the can add an URLRequest::Delegate that
-  // inspects the URL and supplies the username/password at OnAuthRequired()
-  // time. Past data shows this is used extremely infrequently in web pages,
-  // but continue to collect this data.
+  // Try to use the username:password encoded into the URL first.
   if (target_ == HttpAuth::AUTH_SERVER && auth_url_.has_username() &&
       !embedded_identity_used_) {
+    identity_.source = HttpAuth::IDENT_SRC_URL;
+    identity_.invalid = false;
+    // Extract the username:password from the URL.
+    string16 username;
+    string16 password;
+    GetIdentityFromURL(auth_url_, &username, &password);
+    identity_.credentials.Set(username, password);
     embedded_identity_used_ = true;
+    // TODO(eroman): If the password is blank, should we also try combining
+    // with a password from the cache?
     UMA_HISTOGRAM_BOOLEAN("net.HttpIdentSrcURL", true);
+    return true;
   }
 
   // Check the auth cache for a realm entry.
   HttpAuthCache::Entry* entry =
       http_auth_cache_->Lookup(auth_origin_, handler_->realm(),
                                handler_->auth_scheme());
 
   if (entry) {
     identity_.source = HttpAuth::IDENT_SRC_REALM_LOOKUP;
     identity_.invalid = false;
@@ skipping 79 matching lines @@
   DCHECK(CalledOnValidThread());
   return disabled_schemes_.find(scheme) != disabled_schemes_.end();
 }
 
 void HttpAuthController::DisableAuthScheme(HttpAuth::Scheme scheme) {
   DCHECK(CalledOnValidThread());
   disabled_schemes_.insert(scheme);
 }
 
 }  // namespace net