Disable HTTP authentication dialog for XHR with credentials

chrome/browser/ui/login/login_prompt_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <algorithm>
 #include <list>
 #include <map>
 
 #include "base/metrics/field_trial.h"
 #include "base/strings/utf_string_conversions.h"
@@ skipping 1058 matching lines @@
 
   EXPECT_EQ(1, observer.auth_needed_count_);
   EXPECT_EQ(1, observer.auth_supplied_count_);
   EXPECT_EQ(0, observer.auth_cancelled_count_);
   EXPECT_EQ(1, observer_incognito.auth_needed_count_);
   EXPECT_EQ(0, observer_incognito.auth_supplied_count_);
   EXPECT_EQ(0, observer_incognito.auth_cancelled_count_);
   EXPECT_TRUE(test_server()->Stop());
 }
 
+// If an XMLHttpRequest is made with incorrect credentials, there should be no
+// login prompt; instead the 401 status should be returned to the script.
+IN_PROC_BROWSER_TEST_F(LoginPromptBrowserTest,
+                       NoLoginPromptForXHRWithBadCredentials) {
+  const char* kXHRTestPage = "files/login/xhr_with_credentials.html#incorrect";
+
+  ASSERT_TRUE(test_server()->Start());
+
+  content::WebContents* contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  NavigationController* controller = &contents->GetController();
+  LoginPromptBrowserTestObserver observer;
+
+  observer.Register(content::Source<NavigationController>(controller));
+
+  // Load a page which makes a synchronous XMLHttpRequest for an authenticated
+  // resource with the wrong credentials.  There should be no login prompt.
+  {
+    GURL test_page = test_server()->GetURL(kXHRTestPage);
+    WindowedLoadStopObserver load_stop_waiter(controller, 1);
+    browser()->OpenURL(OpenURLParams(
+        test_page, Referrer(), CURRENT_TAB, content::PAGE_TRANSITION_TYPED,
+        false));
+    load_stop_waiter.Wait();
+  }
+
+  base::string16 expected_title(base::UTF8ToUTF16("status=401"));
+
+  EXPECT_EQ(expected_title, contents->GetTitle());
+  EXPECT_EQ(0, observer.auth_supplied_count_);
+  EXPECT_EQ(0, observer.auth_needed_count_);
+  EXPECT_EQ(0, observer.auth_cancelled_count_);
+  EXPECT_TRUE(test_server()->Stop());
+}
+
+// If an XMLHttpRequest is made with correct credentials, there should be no
+// login prompt either.
+IN_PROC_BROWSER_TEST_F(LoginPromptBrowserTest,
+                       NoLoginPromptForXHRWithGoodCredentials) {
+  const char* kXHRTestPage = "files/login/xhr_with_credentials.html#secret";
+
+  ASSERT_TRUE(test_server()->Start());
+
+  content::WebContents* contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  NavigationController* controller = &contents->GetController();
+  LoginPromptBrowserTestObserver observer;
+
+  observer.Register(content::Source<NavigationController>(controller));
+
+  // Load a page which makes a synchronous XMLHttpRequest for an authenticated
+  // resource with the wrong credentials.  There should be no login prompt.
+  {
+    GURL test_page = test_server()->GetURL(kXHRTestPage);
+    WindowedLoadStopObserver load_stop_waiter(controller, 1);
+    browser()->OpenURL(OpenURLParams(
+        test_page, Referrer(), CURRENT_TAB, content::PAGE_TRANSITION_TYPED,
+        false));
+    load_stop_waiter.Wait();
+  }
+
+  base::string16 expected_title(base::UTF8ToUTF16("status=200"));
+
+  EXPECT_EQ(expected_title, contents->GetTitle());
+  EXPECT_EQ(0, observer.auth_supplied_count_);
+  EXPECT_EQ(0, observer.auth_needed_count_);
+  EXPECT_EQ(0, observer.auth_cancelled_count_);
+  EXPECT_TRUE(test_server()->Stop());
+}
+
+// If an XMLHttpRequest is made without credentials, there should be a login
+// prompt.
+IN_PROC_BROWSER_TEST_F(LoginPromptBrowserTest,
+                       LoginPromptForXHRWithoutCredentials) {
+  const char* kXHRTestPage = "files/login/xhr_without_credentials.html";
+
+  ASSERT_TRUE(test_server()->Start());
+
+  content::WebContents* contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  NavigationController* controller = &contents->GetController();
+  LoginPromptBrowserTestObserver observer;
+
+  observer.Register(content::Source<NavigationController>(controller));
+
+  // Load a page which makes a synchronous XMLHttpRequest for an authenticated
+  // resource with the wrong credentials.  There should be no login prompt.
+  {
+    GURL test_page = test_server()->GetURL(kXHRTestPage);
+    WindowedAuthNeededObserver auth_needed_waiter(controller);
+    browser()->OpenURL(OpenURLParams(
+        test_page, Referrer(), CURRENT_TAB, content::PAGE_TRANSITION_TYPED,
+        false));
+    auth_needed_waiter.Wait();
+  }
+
+  ASSERT_FALSE(observer.handlers_.empty());
+  {
+    WindowedAuthNeededObserver auth_needed_waiter(controller);
+    WindowedAuthSuppliedObserver auth_supplied_waiter(controller);
+    LoginHandler* handler = *observer.handlers_.begin();
+
+    ASSERT_TRUE(handler);
+    handler->SetAuth(base::UTF8ToUTF16(bad_username_),
+                     base::UTF8ToUTF16(bad_password_));
+    auth_supplied_waiter.Wait();
+
+    // The request should be retried after the incorrect password is
+    // supplied.  This should result in a new AUTH_NEEDED notification
+    // for the same realm.
+    auth_needed_waiter.Wait();
+  }
+
+  ASSERT_EQ(1u, observer.handlers_.size());
+  WindowedAuthSuppliedObserver auth_supplied_waiter(controller);
+  LoginHandler* handler = *observer.handlers_.begin();
+
+  base::string16 username(base::UTF8ToUTF16(username_digest_));
+  base::string16 password(base::UTF8ToUTF16(password_));
+  handler->SetAuth(username, password);
+  auth_supplied_waiter.Wait();
+
+  WindowedLoadStopObserver load_stop_waiter(controller, 1);
+  load_stop_waiter.Wait();
+
+  base::string16 expected_title(base::UTF8ToUTF16("status=200"));
+
+  EXPECT_EQ(expected_title, contents->GetTitle());
+  EXPECT_EQ(2, observer.auth_supplied_count_);
+  EXPECT_EQ(2, observer.auth_needed_count_);
+  EXPECT_EQ(0, observer.auth_cancelled_count_);
+  EXPECT_TRUE(test_server()->Stop());
+}
+
+// If an XMLHttpRequest is made without credentials, there should be a login
+// prompt.  If it's cancelled, the script should get a 401 status.
+IN_PROC_BROWSER_TEST_F(LoginPromptBrowserTest,
+                       LoginPromptForXHRWithoutCredentialsCancelled) {
+  const char* kXHRTestPage = "files/login/xhr_without_credentials.html";
+
+  ASSERT_TRUE(test_server()->Start());
+
+  content::WebContents* contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  NavigationController* controller = &contents->GetController();
+  LoginPromptBrowserTestObserver observer;
+
+  observer.Register(content::Source<NavigationController>(controller));
+
+  // Load a page which makes a synchronous XMLHttpRequest for an authenticated
+  // resource with the wrong credentials.  There should be no login prompt.
+  {
+    GURL test_page = test_server()->GetURL(kXHRTestPage);
+    WindowedAuthNeededObserver auth_needed_waiter(controller);
+    browser()->OpenURL(OpenURLParams(
+        test_page, Referrer(), CURRENT_TAB, content::PAGE_TRANSITION_TYPED,
+        false));
+    auth_needed_waiter.Wait();
+  }
+
+  ASSERT_EQ(1u, observer.handlers_.size());
+  WindowedAuthCancelledObserver auth_cancelled_waiter(controller);
+  LoginHandler* handler = *observer.handlers_.begin();
+
+  handler->CancelAuth();
+  auth_cancelled_waiter.Wait();
+
+  WindowedLoadStopObserver load_stop_waiter(controller, 1);
+  load_stop_waiter.Wait();
+
+  base::string16 expected_title(base::UTF8ToUTF16("status=401"));
+
+  EXPECT_EQ(expected_title, contents->GetTitle());
+  EXPECT_EQ(0, observer.auth_supplied_count_);
+  EXPECT_EQ(1, observer.auth_needed_count_);
+  EXPECT_EQ(1, observer.auth_cancelled_count_);
+  EXPECT_TRUE(test_server()->Stop());
+}
+
 }  // namespace