fix: prevent native credentials window (#974)

src/request-pipeline/header-transforms.js

@@ -92,6 +92,9 @@ var responseTransforms = {
     'x-content-security-policy-report-only': skip,
     'x-webkit-csp':                          skip,
 
+    // NOTE: Even if we are not able to be authorized, we should prevent showing the native credentials window.
+    'www-authenticate': skip,
+
     // NOTE: We perform CORS checks on our side, so we skip the related headers.
     'access-control-allow-origin': skip,
 

test/server/auth-test.js

@@ -126,7 +126,8 @@ describe('Authentication', function () {
             request(proxy.openSession('http://127.0.0.1:1507/', session), function (err, res, body) {
                 expect(body).equal('Access denied');
                 expect(res.statusCode).equal(401);
-
+                // NOTE: prevent showing the native credentials window.
+                expect(res.headers['www-authenticate']).to.be.undefined;
                 done();
             });
         });