19

I am accessing a web application using Chrome. If I sign out of the app and clear all Chrome history/cookies/etc (even Flash cookies which are now handled by Chrome in the same Clear History area) and then re-access the site, I am automatically logged in without being prompted for credentials.

I then launched Chrome in Incognito mode and was able to reproduce the same behavior. However, the I was prompted upon the first logon while in Incognito mode.

The web application behaves as expected in Internet Explorer 10.

Some info about the application:

  • It's a Sharepoint site using NTLM authentication
  • The credentials are Active Directory-based, as the username is domain\username
  • My connection is over the Internet and there is no AD relationship between my local Windows account, my Windows PC. In other words I (meaning my locally logged on user and my PC) are not in any way part of their AD domain.
  • The site is running SSL on port 443

Why might Chrome be automatically authenticating me?

Howiecamp
  • 1,568
  • 8
  • 32
  • 48
  • If its using AD then its likely not using basic http authentication. If you already authenticated your AD credentials thats likely the reason Chrome isn't asking you to autheitcate again. – Ramhound Oct 24 '13 at 15:10
  • @Ramhound - Good catch. I verified with F12 tools that it is using NTLM authentication. But in any case, how is the site remembering me if I am clearing all browser cookies? There still needs to be a session mechanism to determine that I am the same person as before. Also just to clarify, my only authentication is via the browser, eg I am not authenticating in any other way with their domain and there is no relationship between my machine and their domain. – Howiecamp Oct 24 '13 at 15:25
  • @Ramhound - Also don't forget that IE *is* prompting me again. – Howiecamp Oct 24 '13 at 15:33
  • Use Fiddler or Wireshark to see if it's doing automatic Kerberos/SPNEGO authentication with your login credentials (look for `www-authentication:` HTTP header, etc). It might be caching your login based on IP or something. This is really a problem you need to debug on the server side, but at least from the client side you will be able to see what kind of auth (if any) it's doing on a clean session, and what information (if any) your browser is sending to the remote site. – allquixotic Oct 24 '13 at 15:38
  • 1
    `It's a Sharepoint site using NTLM authentication` - The entire point of NTLM authentication is that you don't get prompted for authentiation. Your credentials are automatically passed. If you want to authenticate as a different user, restart your browser and run it as a different user. – Zoredache Oct 24 '13 at 18:32
  • @Zoredache - Keep in mind this is not an intranet app and there is no NTLM/Kerberos communication between my workstation and the server. It's browser-only. Browsers, regardless of the authentication mechanism (NTLM, etc) need some means of maintaining state. My question is how is that state maintained? After I clear browser cookies, cache, etc there should be no means for the server to remmember who I am. – Howiecamp Oct 26 '13 at 21:36
  • I met the same issue. I think it's Chrome remembering NTLM credential until the window is closed, just like how Chrome (and other browsers) treats [basic authentication](https://en.wikipedia.org/wiki/Basic_access_authentication). Note that this is different from the "[save password](https://support.google.com/chrome/answer/95606)" functionality, which pre-fills the pop up instead of preventing it. – Franklin Yu Aug 16 '17 at 19:50
  • I tried latest Firefox and it has the same issue, so it's not Chrome-only. – Franklin Yu Aug 17 '17 at 13:29

5 Answers5

5

I have same issue. I used to log on to one web site with credentials and now I can't log on using any others. When I log off and try to log on again Chrome puts Authorization header automatically without asking. The site uses local users database (no AD but plain .htpasswd file) and uses Basic authentication.

Already tried cleaning all cookies and saved passwords. No luck. And this happens only on Chrome and only on one PC (on other PCs in Chrome with my Google account it works properly and asks for credenticals after logon)

I've found a workaround for the issue as my main goal was to authenticate as different user. I have run the Fiddler and enabled breakpoints there. So upon request with Authorization header I've forced 401 response and thus made authentication window to appear. Then I've provided necessary credentials and my problem was fixed.

However it doesn't answer the question where those credentials are stored

Ralfeus
  • 196
  • 1
  • 6
2

That site is probably using local storage[1][2] which is like cookies for HTML5.

It has been asked, how to clear the local storage, but unfortunately, Chrome does not currently include local storage in the Clear Browsing Data dialog. In the meantime, you can do it manually by deleting the file(s) corresponding to that site under the Local Storage folder of your User Data Directory.

NetMage
  • 210
  • 2
  • 9
Synetech
  • 68,243
  • 36
  • 223
  • 356
  • *Chrome does not currently include local storage in the Clear Browsing Data dialog* Is this still true today? I'm unsure if it's included under 'Cookies and other site data'. – Max Barraclough Jun 16 '20 at 12:14
  • 1
    I stopped using Chrome a few years ago, but I just checked and I honestly can't tell if it does or not. There's nothing in the *Clear Browsing Data* dialog that mentions local storage, but there is one that says "Site Settings" which I *think* might be local storage. I suspect Chrome avoids using terms like "local settings" to be "user friendly" (the Chrome devs have a tendency to insist on treating users like mentally-challenged babies, which is part of why I quit using Chrome). The [docs](https://support.google.com/chrome/answer/2392709) don't clarify things either. – Synetech Sep 03 '20 at 13:50
  • @Synetech "file(s) corresponding to that site" - Which file(s) specifically? Which file(s) contain the HTTP authentication details? – Programer Beginner Oct 28 '20 at 11:36
  • @ProgramerBeginner, I stopped using Chrome years ago, so I don't know its current system of local-storage. Look in the folder and see what you can find. Open them in a hex-editor and see if you can find the login name (the password might be encrypted). – Synetech Oct 29 '20 at 12:53
0

Uncheck "Continue running background apps when Google Chrome is closed" in Chrome settings and clear browser data.

Fergara
  • 99
  • 2
0

This does not answer the question, but it is a work-around for changing credentials:

  1. Go to Internet Options
  2. Click the Security tab
  3. Click on your best-guess for what zone you think the website may be under. For me, I was using the wrong credentials on a work intranet site, and my domain admins had automatically added the URL to "Local Intranet". I didn't have permission to edit "Sites" at all, I could at least look.
  4. For that zone, click "Custom level..."
  5. Scroll all the way to bottom and choose "Prompt for user name and password"
  6. Click "OK" to save
  7. Restart Chrome so that it will pick up the new settings
  8. Navigate directly to the website in question.
    At first I was prompted for the main intranet website (my home page) and entered my credentials. Then I clicked a link for the site in question, which has the same domain, but a different subdomain. I was not re-prompted. I restarted Chrome again, canceled out of the first prompt, and when I navigated directly to the URL in question, I received a prompt and was able to change my credentials for that site.
  9. Once you have successfully authenticated with the "correct" account, you can change the settings back for auto-login, since Chrome now knows the latest credentials.

Credit for the idea goes to https://sysadminspot.com/windows/google-chrome-and-ntlm-auto-logon-using-windows-authentication/

emragins
  • 203
  • 1
  • 6
0

Chrome appears to cache credentials when you enter them into a prompt for Basic Authentication. Subsequent requests automatically add an Authorization header to each request with an encoded value which allows these requests to skip the need prompt for these credentials.

enter image description here

I ran into this myself recently and after doing a bit of research I ran into the following articles which may help explain the behavior and provide additional ways to clear these cached credentials which may fit your needs.

Resources:

jpierson
  • 307
  • 1
  • 4
  • 13