NoScript is preventing me from logging into my router

[gfrag]

Hello there! I 've been using Noscript for a very long time and has always been my answer to the question "Why firefox?" Recently, I set up a webserver and needed to setup port forwarding in my router. I had quite some time since I last logged in my router (2-3 noscript updates ago, using again Firefox with Noscript installed) and I noticed that (using the exact same procedure as always) I was not able to. "Please enter correct password" and got redirect to log-in screen. At first I suspected password hijacking but then managed to get in using IE. I tried again with Firefox, in Safe mode this time. It worked. I tried with FF in normal mode and ONLY NoScript disabled. Again it worked.
It seems that (after some version update) when NS is enabled (and although I have allowed "All this page" i.e. router's internal IP) I cannot enter the router's WebGUI.

I'm using:
Windows XP 32 SP3 / firefox 3.6.13 / NoScript 2.0.9.2
Linux ubuntu 2.6.35-24-generic / firefox 3.6.13 / NoScript 2.0.9.2

Any ideas why this is happening? Something I can change in NoScript configuration to fix it?

Thank you in advance.

[Giorgio Maone]

It's probably a known bug in your router which prevents X-Do-Not-Track from working with basic authentication.
Worked around in latest development build.

[therube]

See if the latest development build works for you.

Also review, NoScript blocking routers config page.

(heh)

[gfrag]

See if the latest development build works for you.

Also review, NoScript blocking routers config page.

(heh)

Oops! I did what I hate most (double posting). In my defense, it sounded like a different problem than mine (when just reading the very first post). Still, my bad.

Let me thank you both for the prompt response. Since this is something already known and under development, I can just wait for the next version, correct? Since it is not something I use in a daily basis, I 'd rather not mess with any dev versions. Unless, of course, this would give feedback that could help your efforts, in which case I would be more than glad to try it. Just guide me through the procedure.

Thanks again!

[Giorgio Maone]

Unless, of course, this would give feedback that could help your efforts

Knowing your router model and whether latest development build actually works for you would be helpful, indeed.

[gfrag]

Just installed 2.0.9.4rc1: Still no luck. Router presents the log-in screen, I input my credentials, the screen flashes and returns to "incorrect password"

My router is a "NetFasteR IAD 2", my ISP is HOL (Hellas On Line) and I think the manufacturer is INTRACOM TELECOM

Do I need to revert to latest stable? Can I just use the download link to downgrade?

[griffyn]

I am having a similar issue with my router also. When I input the password and click on ok the login box disappears and then just reappears; it's an endless loop until I click on cancel. I installed the latest dev build mentioned in this thread and then tried it again. It did not work. I have a Linksys WRT120N w/firmware 1.0.05. Now I would like to note that I also have a Linksys WRT54G w/firmware 8.00.2 and a Linksys BEFSR41 w/firmware 1.04.09 and I can log into both of those with no problems. So Noscript works fine with the older equipment without any issues, but is having issues with the newer equipment.

[Giorgio Maone]

Did you restart the browser after installing latest development build?

If you did, could you use the HttpFox add-on to show me the relevant HTTP traffic bits?

At any rate, keeping latest development build you should be able to definitely work-around by adding your router's IP to the noscript.doNotTrack.exceptions about:config preference.

[gfrag]

I installed HttpFox (not very familiar with it, please let me know if I'm not giving you the correct output)

When I send my credentials (POST):

Code: Select all

Request-Line)	POST /cgi-bin/login.exe HTTP/1.1
Host	192.168.2.1
User-Agent	Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13 (.NET CLR 3.5.30729)
Accept	text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language	en-us,en;q=0.5
Accept-Encoding	gzip,deflate
Accept-Charset	ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive	115
Referer	http://192.168.2.1/
X-Do-Not-Track	1
Connection	keep-alive
Content-Type	application/x-www-form-urlencoded
Content-Length	32

And the answer I get:

Code: Select all

(Status-Line)	HTTP/1.0 302 Found
Server	Apache
Pragma	no-cache
Cache-Control	max-age=0, must-revalidate
Connection	close
Location	http://192.168.2.1/loginpserr.stm
Content-Type	text/html

[gfrag]

UPDATE:

I've added my router's IP in the noscript.doNotTrack.exceptions and it works!

A couple of questions, bear with me please:

Is this option available only in dev, or can I downgrade to latest stable and set it there?
Does this exception compromise the protection I get from NoScript? What does it do?

I guess this is OS independent, correct? I've tried it on my win-box only...

[Giorgio Maone]

Is this option available only in dev, or can I downgrade to latest stable and set it there?

It works only in dev so far, because of a bug in stable.

Does this exception compromise the protection I get from NoScript? What does it do?

Not at all, it just disables the X-Do-Not-Track header for your router (where it was useless anyway).

I guess this is OS independent, correct? I've tried it on my win-box only...

It is independent from your client OS, yes, because it appears to be a bug in your router, which apparently cannot cope with the extra header.
And it's very strange, because I believed it affected HTTP basic authentication only, but in your case it seems a form-based authentication.

[al_9x]

Is it possible exempt non routable IPs, i.e. to modify headers after dns?

[Giorgio Maone]

Is it possible exempt non routable IPs, i.e. to modify headers after dns?

Theoretically yes (by moving current simple observer inside ABE's machinery), but I'm not very comfortable with such a solution until I fully understand what's going on.
At least two of these routers report "Apache" as their Server header, so I'm afraid we could find other non-router (and non-LAN) situations in the wild.
This is really a weird bug, isn't it?