WMS basic authentication is using OSM account

[anonymous]

When JOSM is acessing a WMS server which requires Basic Authentication, it will send the OSM username and password.
Besides the security aspect it is currently not possible to use such WMS servers with different login data.

Some GUI option to set login data for WMS would be nice.
OSM login data should never be sent to other servers requiring Basic Authentication without permission.

[bastiK]

Could you name a WMS with Basic Auth setup?

[anonymous]

This is just an example. Remember JOSM sends your OSM login data to this server.

​http://security.demo.52north.org/wss/service/wms_demis/httpauth?

demo accounts:

• alice/alice: Full access
• bob/bob: Limited access
• guest/guest: Very limited access

[skyper]

Replying to anonymous:

OSM login data should never be sent to other servers requiring Basic Authentication without permission.

This is a critical bug !

[skyper]

I split the enhancement part to #7122

As it is easy to add wms servers to the list this defect is even a blocker !

[stoecker]

In [4690/josm]:

see #7086 - fix passing auth information to wrong server

[stoecker]

I did a basic fix introducing host-name aware authentication settings which fixes this immediate problem. But it still is not perfect.

[stoecker]

In [4692/josm]:

see #7086 - save other passwords in JOSM prefs

[anonymous]

With regard to the current patches: it seems like JOSM sometimes "forgot" sending the auth information (maybe that should be another ticket). Before the patches the auth dialog just appeared again. With the current josm-latest I get HTTP 401 errors without auth dialog resulting in error tiles.

[simon04]

It seems to be working okay, i.e., one manages to load images w/o the OSM password being sent.

The problem I experienced w/ r9312 and the WMS from comment:2 is in the context of parallel image loading:

1. 3 WMS requests are fired and executed
2. All 3 obtain HTTP 401
3. The first one requests the saved credentials from the preferences (I entered+saved them while adding the WMS layer). It registers credentialsTried (in org/openstreetmap/josm/io/auth/DefaultAuthenticator.java:55, which is not host specific!), obtains the credentials from the preferences and loads the image
4. The 2nd and 3rd request however reach credentialsTried already set from the first host. This causes 2 credential dialogs to be shown at org/openstreetmap/josm/io/auth/AbstractCredentialsAgent.java:46

So two credential dialogs are shown despite having the correct credentials set in the preferences.

To be done:

• make org.openstreetmap.josm.io.auth.DefaultAuthenticator#credentialsTried host aware
• somehow fix this parallel request issue

[simon04]

Not sending OSM credentials has been fixed 4 years ago. For other problems/enhancements → #7122.