MicrosoftEdge / MicrosoftEdge/WebView2Feedback

[Problem/Bug]: 403 forbidden when authenticating a site with multiple windows open to that site

Open
#5,168 0 comments 0 reactions 1 assignee View on GitHub

@Navdeep-ss is already working on this.

Since Mar 17, 2025.

bug
Dominant language
PowerShell
Stars
526
Forks
67
PR merge metrics
No merged PRs in 30d

Description

What happened?

If you detect the BasicAuthenticationRequested event and set Cancel to false, and then open several windows to the same site which requires auth, when you type the credentials, some of the windows get a 403 forbidden status in NavigationCompleted.

Haven't seen this in Edge.

Importance

Low. My app is not very affected, or this only affects development.

Runtime Channel

Prerelease (Edge Canary/Dev/Beta)

Runtime Version

136.0.3192.0 canary

SDK Version

3116.0

Framework

Winforms

Operating System

Windows 11

OS Version

24H2 - 26100.3194

Repro steps

Download the WinForms webview2 sample
In BrowserForm::WebView2Control_CoreWebView2InitializationCompleted, add: this.webView2Control.CoreWebView2.NewWindowRequested += NewWindowRequested;

And set that handler to:

private async void NewWindowRequested(object sender, CoreWebView2NewWindowRequestedEventArgs e)
{
	e.Handled = true;
	using (e.GetDeferral())
	{
		Form form = new Form();
		form.Visible = true;
		form.Size = new Size(800, 600);
		WebView2 webView = new WebView2();
		await webView.EnsureCoreWebView2Async();

		webView.CoreWebView2.BasicAuthenticationRequested += (object sender, CoreWebView2BasicAuthenticationRequestedEventArgs args) =>
		{
			args.Cancel = false;
		};
		form.Controls.Add(webView);
		webView.CoreWebView2.NavigationCompleted += (object sender, CoreWebView2NavigationCompletedEventArgs args) =>
		{
			if  (!args.IsSuccess && args.WebErrorStatus != CoreWebView2WebErrorStatus.ValidAuthenticationCredentialsRequired)
			{
				var e = args.HttpStatusCode;
			}
		};
		webView.Dock = DockStyle.Fill;
		e.NewWindow = webView.CoreWebView2;
	}
}
  1. Set a breakpoint on var e = args.HttpStatusCode;
  2. start the app
  3. open devtools
  4. execute window.open("https://authenticationtest.com/HTTPAuth") 4 times
  5. in one of those windows, type in the credentials user/pass
  6. Notice that the breakpoint gets hit and after continuing, at least one of those windows gets the 403 Forbidden error page.
Repros in Edge Browser

No, issue does not reproduce in the corresponding Edge version

Regression

No, this never worked

Last working version (if regression)

No response

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.