[Feature] Restrain sending http credentials on a specific hostname #20464

Let's consider doing a navigation on a page that requires HTTP authentication. From the browser, this would typically show a dialog prompting for user credentials.

With Playwright, this pair of string "username" and "password" can be set on the browser context with the code below:

const context = await browser.newContext({httpCredentials: { username: 'user', password: 'pass' }

That allows Playwright to use these credentials when any servers respond with HTTP 401 unauthorized, in order to secure the connection. This works fine regardless of the HTTP authentication mecanism: basic, ntlm, kerberos...

However, we have a concern in terms of security, about these credentials being sent to any servers, other than the one we specified the credentials for.

In order to restrain sending HTTP credential to only the expected server, we would like to have the ability to specify a hostname, additionaly to the current pair username/password set on the browser context. So when an authorization response is received from servers, the credentials are sent only if the server hostname in the request matches case insensitive the specified hostname. Otherwise, if the hostname does not match, then the credentials wouldn't be sent, same as if no credentials were configured (likely causing the server to fail the authorization and return 401 HTTP status).

Also, in order to not break the compatibility with previous project, that additional parameter for the hostname needs to be optional. When not present, it should behave exactly the same way as before, namely always sending the credentials to any server.

We submitted a PR for that matter: #20374. We could also consider a more advance matching algorighm if you prefer (such as regexp on full request path), but we thought doing a simple string compare of the full hostname could be enough as a first step. Later, we are also interested into improving the Java wrapper.