Google Chrome Domain Authentication and Clear Text Passwords in the HTTP Header

Question

In an answer to Windows Authentication with Google Chrome it is indicated that Chrome does not yet support Auto NTLM Authentication which means that users authenticating to sites using Windows Authentication are prompted for a login. Which is annoying but not a problem. Where the problem resides is that the users password is then sent in clear text to the authenticating site.

I whipped up a quick ASP.NET script that pulls the password out of the AUTH_PASSWORD in Request.ServerVariables collection. Both Safari and Opera prompt for user credentials but neither sends the password in clear text in the HTTP header. I find this especially odd since Chrome like Safari is based on WebKit.

What is the difference between the way Chrome Authenticates in comparison to other browsers and why does it send the password to a site in this manner?

Answer 1

NTLM is currently being ported to Chrome. See this. Just wait for the next version.

Answer 2

One possibility is that chrome may not support NTLM at all, and Chrome simply falls back to HTTP BASIC authentication. Can you obtain the exact headers in use with wireshark or similar?

Answer 3

In reply to your comment on bdonlan's answer:

I am guessing I won't be able to see the authentication because the site I am running against is using SSL.

The burp proxy tool allows watching (and even modifying) HTTP requests and responses, and it can act as a HTTPS proxy too. (It may or may not work, depending on how Chrome uses HTTPS proxies.)

Answer 4

From what I can tell via Wireshark, Chrome does support NTLM authentication. What it does not support is single sign-on by passing through your existing credentials.

This is why the AUTH_PASSWORD field is empty.