Home Dashboard Directory Help
Search

Pasting passwords into Basic Auth prompts using context menu doesn't work correctly by Jim McNugget


Status: 

Closed
 as Not Reproducible Help for as Not Reproducible


Type: Bug
ID: 785981
Opened: 5/1/2013 4:50:54 AM
Access Restriction: Public
0
Workaround(s)
view
0
User(s) can reproduce this bug

Description



If I am prompted to authenticate via Basic Auth in IE10 and have a password on the clipboard from somewhere else:

- If I paste it into the password box using Ctrl-V shortcut, I authenticate successfully with the server
- If I paste the same password by right-clicking in the Password field and clicking Paste, authentication fails. Investigation shows a blank password is being sent to the server even though characters show in the box.
Details
Sign in to post a comment.
Posted by Jim McNugget on 6/23/2013 at 1:45 AM
OK after searching some more on the subject, I found quite an old MSDN blog that describes the problem and solution accurately. I'll link here for completeness if anyone is searching:

http://blogs.msdn.com/b/ieinternals/archive/2009/11/22/clipboard-paste-bug-in-windows-7-password-prompt.aspx

Turns out that the problem is in Windows, not Internet Explorer and the following hotfix solves it (I guess all those unable-to-repeat people had it installed already):

http://support.microsoft.com/kb/2547752
Posted by Microsoft on 6/21/2013 at 6:40 AM
Thank you for your feedback.

We are currently unable to reproduce this issue as described.


We value your feedback. If you have additional information that can help us recreate this issue — such as a specific url, more detailed steps, test results from different machines, or additional conditions — please reactivate the bug or submit a new bug with more details on how to reproduce the issue. You can also read the guidelines at https://connect.microsoft.com/IE/content/content.aspx?ContentID=16254 regarding filing a good bug report.

Best regards,

The Internet Explorer Team
Posted by Microsoft on 6/12/2013 at 8:31 AM
Thank you for your feedback. We will be investigating this issue further.

Best regards,

The Internet Explorer Team
Posted by Jim McNugget on 5/8/2013 at 11:24 AM
I successfully repeated on a fourth Windows 7 (32bit) machine with IE10. I haven't found one on which the bug doesn't occur yet.

IECUSTOMIZER: When using the authtest2 page and pasting a password by right-clicking, did you then see the password you pasted shown on the following page? For authtest2, a "successful" authentication does not mean the bug did not occur.
Posted by Jim McNugget on 5/8/2013 at 1:56 AM
Hmm, no custom security zones, no - just "Internet". Are you testing on Windows 7 (x64, 32bit IE)?

I'll see if I can repeat on some more machines.
Posted by IECustomizer on 5/7/2013 at 11:51 PM
Hi Jim,
I can't reproduce the issue either....

check Tools>Internet Options>Security tab,,,, are you using custom security zone settings...
Posted by Jim McNugget on 5/3/2013 at 1:55 PM
I reopened this because I can see from my server logs that nobody bothered to visit the proof of concept page I posted as a followup.

I have since verified this problem occurs on other machines running IE9-10 and Windows 7.
Posted by Jim McNugget on 5/2/2013 at 12:46 PM
I've been testing some more and have built a second demo, using a PHP script to send a 401 code to trigger the authentication prompt. This script then prints out the password that was given (it doesn't even check if it's "correct") so this way we can see what IE has been sending in the copy-paste situation I describe. Turns out it's an empty string! You can try this at http://mintrasystems.com/authtest2
Posted by Jim McNugget on 5/2/2013 at 9:19 AM
I have a demo site I put up at http://mintrasystems.com/authtest - this will prompt you for Basic Auth.

Then, username is test. Copy the password "woftam" (without quotes) to the clipboard. Paste into the password box with Ctrl-V, should authenticate fine and show a small success message. Clear the cached credentials by restarting IE then repeat but right click and choose to Paste the password from the context menu this time. Authentication should fail.

I am running IE10 on Windows 7. I have repeated this on several different machines, running both IE9 and 10. If you really cannot repeat I will see if I can find a different machine not built from our standard company image and verify.
Posted by Microsoft on 5/2/2013 at 8:39 AM
Thank you for your feedback.

We are currently unable to reproduce this issue as described.

We value your feedback. If you have additional information that can help us recreate this issue — such as a specific url, more detailed steps, test results from different machines, or additional conditions — please reactivate the bug or submit a new bug with more details on how to reproduce the issue. You can also read the guidelines at https://connect.microsoft.com/IE/content/content.aspx?ContentID=16254 regarding filing a good bug report.

Best regards,

The Internet Explorer Team
Sign in to post a workaround.