Skip to content

Quirks when onion authentication prompt is shared between two tabs

Steps to reproduce

  1. Visit an onion site that requires authentication (without a saved key in the browser).
  2. Wait for authentication popup but do not interact with it.
  3. Open another tab and visit another onion site that requires authentication.
  4. Wait for authentication popup for the new tab.
  5. Enter the key and with focus still in the input press "Enter".

Result

The same key is submitted for both tabs.

Expect

The key should only be submitted for the current tab.

Cause

There is only one onionsite authentication prompt per window, as such two tabs will share the same DOM prompt. Currently we launch separate instances of OnionServicesAuthPrompt for each tab, as if they are independent, even though they share the same elements.

In particular, the password input is shared by both tabs. E.g. switching between tabs does not clear the input.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information