custom protocol handler for "ssh" has username stripped off [410423931]

Assigned

Bug

Status Update

No update yet.

Description

va...@chromium.org

created issue #1

Apr 14, 2025 08:23AM

the Secure Shell extension registers a handler for `ssh` URIs using `navigator.registerProtocolHandler`. this has worked for a while now.

people are reporting that the username is no longer being passed through (see

issue 400635416

). so if they use `ssh://root@localhost`, Chrome will pass Secure Shell only `ssh://localhost`.

pretty sure this used to work, but i don't have a way of checking old Chrome versions to bisect it down.

Comments

me...@google.com <me...@google.com> #2Apr 14, 2025 04:47PM

Assigned to vi...@google.com.

Afaict way back in M117 this was changed in commit 54da0ed8798fba50742e799fc2edfcc31c39ce3d as part of

bug 40177637

to now intentionally strip credentials from any protocol handler. The spec (

https://html.spec.whatwg.org/multipage/system-state.html#protocol-handler-invocation) also says to strip the username and password, so this seems to be working as intended?

me...@google.com <me...@google.com> #3Apr 14, 2025 04:47PM

+visiedo to confirm that this is indeed the expected behavior

va...@chromium.org <va...@chromium.org> #4Apr 15, 2025 03:15AM

i agree with the spec interpretation. i disagree with it, but Chromium following the spec means breaking existing URIs is WAI. i'll harass Asanka next time i see him in the office ;).

va...@chromium.org <va...@chromium.org> #5Apr 15, 2025 03:16AM

https://github.com/whatwg/html/commit/5b01d3156ff228a851c5ac0e9fddc0f8397b7b38

IssueTracker

This issue is a part of the Chromium tracker.