Multiple http auth details on the same site + chrome save password functionality, is there any way to handle this case?

Question

Google Chrome seems to be saving passwords on a per site basis, but I'm developing a site where I'd like to have different http authentication details depending on the directory accessed AND have Chrome remember this.

That is to say, http://example.com/a and http://example.com/b have different http user/password combinations. I'd like Chrome to remember both, such that when I enter http://example.com/a I'm accessing with the corresponding user/password combo for /a, and likewise for /b. If I use the built in function to save passwords in Chrome, the browser saves both user/password combinations for http://example.com globally and doesn't remember which one to use depending on the address, instead defaulting to one of them for any address accessed on http://example.com

Is there any way around this, besides setting up different subdomains for each directory?

Solution

If you specify different realms for the different subfolders, Chrome will behave properly, for example this works just fine in nginx:

    location /gabinete-rivera {
        auth_basic "Hijos de Rivera";
        auth_basic_user_file /home/www/public/gabinete-rivera-app/.htpasswd;
        index  index.php index.html;
        try_files $uri $uri/ /index.php?$query_string;
    }

    location /gabinete-gases {
        auth_basic "Gases Fluorados";
        auth_basic_user_file /home/www/public/gabinete-gases-app/.htpasswd;
        index  index.php index.html;
        try_files $uri $uri/ /index.php?$query_string;
    }

Comments

[Alain Pannetier]

Wow this is from 2013 and in version 57, 2017 this is still not fixed... And this is the browser that has nearly 60% market share?

[Mahn]

@AlainPannetier yep, to this day I still haven't found a workaround, I just resort to using subdomains or inputting passwords manually every time.

[Alain Pannetier]

lol. I've been moaning decades about closed source and now I have a problem with open source: I just want to clone and customise everything. Chromium is easy (albeit lengthy) to rebuild. But their developer have become so arrogant, as their market share increased, that I'm only using for development. And I just rolled back to 52 because opening the devtools in 57 just... crashed chrome. I might give it a try though. I'll let tou know.

[Mahn]

@AlainPannetier the thing with Chromium is that the code base is enormous, I get the feeling it would be easier to refactor the entire linux kernel than making an interface change there. I found it too daunting but maybe you have better luck than me there.

[Tomasz Pala]

Well, this has been working in Firefox ...till 3.0 - and then they've "fixed" it.

[LPChip]

Why not use something like LastPass that does support multiple site logins consequently?

[user1686]

Do all paths specify the same HTTP authentication "realm", or are they separate?

[Mahn]

The question is about HTTP authentication, i.e. this: i.imgur.com/WsXRu7J.png. That cannot be hijacked with a plugin or javascript.