From Bugzilla Helper: User-Agent: Mozilla/5.0 (Windows; U; WinNT4.0; en-US; m18) Gecko/20000913 BuildID: 2000091317 Currently authentication dialogs for proxy servers and for authenticating to web sites are identical. This might be a potential security risk, since a user may enter his proxy server username/password in response to an auth request from a web site. Admittedly this may be a social problem rather than a real, live security issue but I see it as valid. Communicator 4.7 (at least, probably more) properly stated in its dialog that it wanted proxy credentials when it was given a proxy authentication request. IE (or at least the version I have handy) currently does *not* do this, though they should.

Adam I am hoping this is another bug similar to 50682...

Yes I think it is. I'm marking it a duplicate. *** This bug has been marked as a duplicate of 50682 ***

No, this is not related to bug 50682. A much closer cousin is bug 38008. Let me try to clarify: In NC4, you get password dialogs when HTTP calls for it. If a password is required for proxy access, the dialog looks like this: [ Username and Password Required [X] ] Proxy authentication required for www.example.com at proxyhost:80: User Name: [ ] Password: [ ] [ OK ] [ Cancel ] |___________________________________________________| However, if the password is required for Basic authentication on a site realm, the dialog looks like this: [ Username and Password Required [X] ] Enter username for Basic Authentication Realm at www.example.com: User Name: [ ] Password: [ ] [ OK ] [ Cancel ] |___________________________________________________| By contrast, Mozilla (or did, I have not tried recent builds, too busy) currently shows a dialog that does not allow the user to distinguish whether he is issuing a username and password for a proxy server or for a site realm. This could result in a user inadvertently issuing his proxy username and password to a remote site, which could result in local server compromise.

Ah, I see. Not Adam's bug then. -->Networking. Ideally we want different titles (`Authentication required' vs. `Proxy authentication required'), different labels for the server name (`Server:' vs. `Proxy:'), and maybe even different icons too.

One additional factor is that you should really only need to log into a proxy server once, not for each domain you are browsing to. Right now if you look at another domain it seems to want to re-authenticate to the proxy.

Thats only becuz of another bug 32335 which should be landing in soon... to darin and setting to future.

Ok, this bug cannot be fixed without an API change. See bugs 59609 and 46859 for a related discussion.

added keyword arch.

This was fixed in bug 60588. *** This bug has been marked as a duplicate of 60588 ***

Verified dupe.