Don't use IDENT_SRC_URL for HttpAuth challenges. IE hasn't supported it for years, and at worst ...

net/http/http_auth_controller.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_auth_controller.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/metrics/histogram.h"
 #include "base/string_util.h"
@@ skipping 432 matching lines @@
   // since the entry in the cache may be newer than what we used last time.
   http_auth_cache_->Remove(auth_origin_, handler_->realm(),
                            handler_->auth_scheme(), identity_.credentials);
 }
 
 bool HttpAuthController::SelectNextAuthIdentityToTry() {
   DCHECK(CalledOnValidThread());
   DCHECK(handler_.get());
   DCHECK(identity_.invalid);
 
-  // Try to use the username:password encoded into the URL first.
+  // Do not try to use the username:password encoded into the URL.  At worst,
+  // this represents a session fixation attack against basic auth, and as it
+  // turns out, IE hasn't supported this for years. If a caller really wants
+  // to use embedded identities, the can add an URLRequest::Delegate that
+  // inspects the URL and supplies the username/password at OnAuthRequired()
+  // time. Past data shows this is used extremely infrequently in web pages,
+  // but continue to collect this data.
   if (target_ == HttpAuth::AUTH_SERVER && auth_url_.has_username() &&

[cbentzel, 2012/02/06 21:18:58]

Should this entire block be removed? Or do you want to keep that histogram?

[Tom Sepez, 2012/02/06 21:22:02]

I wants to keep the histogram.

       !embedded_identity_used_) {
-    identity_.source = HttpAuth::IDENT_SRC_URL;
-    identity_.invalid = false;
-    // Extract the username:password from the URL.
-    string16 username;
-    string16 password;
-    GetIdentityFromURL(auth_url_, &username, &password);
-    identity_.credentials.Set(username, password);
     embedded_identity_used_ = true;
-    // TODO(eroman): If the password is blank, should we also try combining
-    // with a password from the cache?
     UMA_HISTOGRAM_BOOLEAN("net.HttpIdentSrcURL", true);
-    return true;
   }
 
   // Check the auth cache for a realm entry.
   HttpAuthCache::Entry* entry =
       http_auth_cache_->Lookup(auth_origin_, handler_->realm(),
                                handler_->auth_scheme());
 
   if (entry) {
     identity_.source = HttpAuth::IDENT_SRC_REALM_LOOKUP;
     identity_.invalid = false;
@@ skipping 79 matching lines @@
   DCHECK(CalledOnValidThread());
   return disabled_schemes_.find(scheme) != disabled_schemes_.end();
 }
 
 void HttpAuthController::DisableAuthScheme(HttpAuth::Scheme scheme) {
   DCHECK(CalledOnValidThread());
   disabled_schemes_.insert(scheme);
 }
 
 }  // namespace net