Page 1 of 1
NoScript is preventing me from logging into my router
Posted: Fri Jan 07, 2011 8:29 pm
by gfrag
Hello there! I 've been using Noscript for a very long time and has always been my answer to the question "Why firefox?" Recently, I set up a webserver and needed to setup port forwarding in my router. I had quite some time since I last logged in my router (2-3 noscript updates ago, using again Firefox with Noscript installed) and I noticed that (using the exact same procedure as always) I was not able to. "Please enter correct password" and got redirect to log-in screen. At first I suspected password hijacking but then managed to get in using IE. I tried again with Firefox, in Safe mode this time. It worked. I tried with FF in normal mode and ONLY NoScript disabled. Again it worked.
It seems that (after some version update) when NS is enabled (and although I have allowed "All this page" i.e. router's internal IP) I cannot enter the router's WebGUI.
I'm using:
Windows XP 32 SP3 / firefox 3.6.13 / NoScript 2.0.9.2
Linux ubuntu 2.6.35-24-generic / firefox 3.6.13 / NoScript 2.0.9.2
Any ideas why this is happening? Something I can change in NoScript configuration to fix it?
Thank you in advance.
Re: NoScript is preventing me from logging into my router
Posted: Fri Jan 07, 2011 9:09 pm
by Giorgio Maone
It's probably a known bug in your router which prevents X-Do-Not-Track from working with basic authentication.
Worked around in
latest development build.
Re: NoScript is preventing me from logging into my router
Posted: Fri Jan 07, 2011 9:10 pm
by therube
See if the latest
development build works for you.
Also review,
NoScript blocking routers config page.
(heh)
Re: NoScript is preventing me from logging into my router
Posted: Fri Jan 07, 2011 9:33 pm
by gfrag
Oops! I did what I hate most (double posting). In my defense, it sounded like a different problem than mine (when just reading the very first post). Still, my bad.
Let me thank you both for the prompt response. Since this is something already known and under development, I can just wait for the next version, correct? Since it is not something I use in a daily basis, I 'd rather not mess with any dev versions. Unless, of course, this would give feedback that could help your efforts, in which case I would be more than glad to try it. Just guide me through the procedure.
Thanks again!
Re: NoScript is preventing me from logging into my router
Posted: Fri Jan 07, 2011 9:37 pm
by Giorgio Maone
gfrag wrote:Unless, of course, this would give feedback that could help your efforts
Knowing your router model and whether
latest development build actually works for you would be helpful, indeed.
Re: NoScript is preventing me from logging into my router
Posted: Fri Jan 07, 2011 10:05 pm
by gfrag
Just installed 2.0.9.4rc1: Still no luck. Router presents the log-in screen, I input my credentials, the screen flashes and returns to "incorrect password"
My router is a "NetFasteR IAD 2", my ISP is HOL (Hellas On Line) and I think the manufacturer is INTRACOM TELECOM
Do I need to revert to latest stable? Can I just use the download link to downgrade?
Re: NoScript is preventing me from logging into my router
Posted: Fri Jan 07, 2011 11:31 pm
by griffyn
I am having a similar issue with my router also. When I input the password and click on ok the login box disappears and then just reappears; it's an endless loop until I click on cancel. I installed the latest dev build mentioned in this thread and then tried it again. It did not work. I have a Linksys WRT120N w/firmware 1.0.05. Now I would like to note that I also have a Linksys WRT54G w/firmware 8.00.2 and a Linksys BEFSR41 w/firmware 1.04.09 and I can log into both of those with no problems. So Noscript works fine with the older equipment without any issues, but is having issues with the newer equipment.
Re: NoScript is preventing me from logging into my router
Posted: Fri Jan 07, 2011 11:36 pm
by Giorgio Maone
Did you restart the browser after installing
latest development build?
If you did, could you use the HttpFox add-on to show me the relevant HTTP traffic bits?
At any rate, keeping
latest development build you should be able to definitely work-around by adding your router's IP to the
noscript.doNotTrack.exceptions about:config preference.
Re: NoScript is preventing me from logging into my router
Posted: Sat Jan 08, 2011 12:01 am
by gfrag
I installed HttpFox (not very familiar with it, please let me know if I'm not giving you the correct output)
When I send my credentials (POST):
Code: Select all
Request-Line) POST /cgi-bin/login.exe HTTP/1.1
Host 192.168.2.1
User-Agent Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13 (.NET CLR 3.5.30729)
Accept text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language en-us,en;q=0.5
Accept-Encoding gzip,deflate
Accept-Charset ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive 115
Referer http://192.168.2.1/
X-Do-Not-Track 1
Connection keep-alive
Content-Type application/x-www-form-urlencoded
Content-Length 32
And the answer I get:
Code: Select all
(Status-Line) HTTP/1.0 302 Found
Server Apache
Pragma no-cache
Cache-Control max-age=0, must-revalidate
Connection close
Location http://192.168.2.1/loginpserr.stm
Content-Type text/html
Re: NoScript is preventing me from logging into my router
Posted: Sat Jan 08, 2011 12:13 am
by gfrag
UPDATE:
I've added my router's IP in the noscript.doNotTrack.exceptions and it works!
A couple of questions, bear with me please:
Is this option available only in dev, or can I downgrade to latest stable and set it there?
Does this exception compromise the protection I get from NoScript? What does it do?
I guess this is OS independent, correct? I've tried it on my win-box only...
Re: NoScript is preventing me from logging into my router
Posted: Sat Jan 08, 2011 12:20 am
by Giorgio Maone
gfrag wrote:Is this option available only in dev, or can I downgrade to latest stable and set it there?
It works only in dev so far, because of a bug in stable.
gfrag wrote:
Does this exception compromise the protection I get from NoScript? What does it do?
Not at all, it just disables the
X-Do-Not-Track header for your router (where it was useless anyway).
gfrag wrote:
I guess this is OS independent, correct? I've tried it on my win-box only...
It is independent from your client OS, yes, because it appears to be a bug in your router, which apparently cannot cope with the extra header.
And it's very strange, because I believed it affected HTTP basic authentication only, but in your case it seems a form-based authentication.
Re: NoScript is preventing me from logging into my router
Posted: Sat Jan 08, 2011 6:19 am
by al_9x
Is it possible exempt non routable IPs, i.e. to modify headers after dns?
Re: NoScript is preventing me from logging into my router
Posted: Sat Jan 08, 2011 9:16 am
by Giorgio Maone
al_9x wrote:Is it possible exempt non routable IPs, i.e. to modify headers after dns?
Theoretically yes (by moving current simple observer inside ABE's machinery), but I'm not very comfortable with such a solution until I fully understand what's going on.
At least two of these routers report "Apache" as their Server header, so I'm afraid we could find other non-router (and non-LAN) situations in the wild.
This is really a weird bug, isn't it?