Use AuthCredentials throughout the network stack instead of username/password.

This is a refactor only - no behavior change should happen.

Review URL: http://codereview.chromium.org/8340026

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@107766 0039d316-1c4b-4281-b951-d872f2087c98

80 files changed, 571 insertions, 607 deletions

diff --git a/chrome/browser/extensions/extension_webrequest_api.cc b/chrome/browser/extensions/extension_webrequest_api.cc
index ad28943..6ac9532 100644
--- a/chrome/browser/extensions/extension_webrequest_api.cc
+++ b/chrome/browser/extensions/extension_webrequest_api.cc
@@ -1696,13 +1696,14 @@ bool WebRequestEventHandled::RunImpl() {
       EXTENSION_FUNCTION_VALIDATE(value->GetDictionary(
           keys::kAuthCredentialsKey,
           &credentials_value));
-      response->auth_credentials.reset(new net::AuthCredentials());
+      string16 username;
+      string16 password;
       EXTENSION_FUNCTION_VALIDATE(
-          credentials_value->GetString(keys::kUsernameKey,
-                                       &response->auth_credentials->username));
+          credentials_value->GetString(keys::kUsernameKey, &username));
       EXTENSION_FUNCTION_VALIDATE(
-          credentials_value->GetString(keys::kPasswordKey,
-                                       &response->auth_credentials->password));
+          credentials_value->GetString(keys::kPasswordKey, &password));
+      response->auth_credentials.reset(
+          new net::AuthCredentials(username, password));
     }
   }
 
diff --git a/chrome/browser/ui/login/login_prompt.cc b/chrome/browser/ui/login/login_prompt.cc
index 4ed400f..36d3efd 100644
--- a/chrome/browser/ui/login/login_prompt.cc
+++ b/chrome/browser/ui/login/login_prompt.cc
@@ -360,7 +360,7 @@ void LoginHandler::SetAuthDeferred(const string16& username,
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
 
   if (request_) {
-    request_->SetAuth(username, password);
+    request_->SetAuth(net::AuthCredentials(username, password));
     ResetLoginHandlerForRequest(request_);
   }
 }
diff --git a/net/base/auth.cc b/net/base/auth.cc
index 104400f..cef2e25 100644
--- a/net/base/auth.cc
+++ b/net/base/auth.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "net/base/auth.h"
+#include "net/base/zap.h"
 
 namespace net {
 
@@ -28,7 +29,30 @@ AuthData::~AuthData() {
 AuthCredentials::AuthCredentials() {
 }
 
+AuthCredentials::AuthCredentials(const string16& username,
+                                 const string16& password)
+    : username_(username),
+      password_(password) {
+}
+
 AuthCredentials::~AuthCredentials() {
 }
 
+void AuthCredentials::Set(const string16& username, const string16& password) {
+  username_ = username;
+  password_ = password;
+}
+
+bool AuthCredentials::Equals(const AuthCredentials& other) const {
+  return username_ == other.username_ && password_ == other.password_;
+}
+
+bool AuthCredentials::Empty() const {
+  return username_.empty() && password_.empty();
+}
+
+void AuthCredentials::Zap() {
+  ZapString(&password_);
+}
+
 }  // namespace net
diff --git a/net/base/auth.h b/net/base/auth.h
index 386adad..3f856c4 100644
--- a/net/base/auth.h
+++ b/net/base/auth.h
@@ -47,17 +47,35 @@ class NET_EXPORT AuthChallengeInfo :
 class NET_EXPORT AuthCredentials {
  public:
   AuthCredentials();
+  AuthCredentials(const string16& username, const string16& password);
   ~AuthCredentials();
 
+  // Set the |username| and |password|.
+  void Set(const string16& username, const string16& password);
+
+  // Determines if |this| is equivalent to |other|.
+  bool Equals(const AuthCredentials& other) const;
+
+  // Returns true if all credentials are empty.
+  bool Empty() const;
+
+  // Overwrites the password memory to prevent it from being read if
+  // it's paged out to disk.
+  void Zap();
+
+  const string16& username() const { return username_; }
+  const string16& password() const { return password_; }
+
+ private:
   // The username to provide, possibly empty. This should be ASCII only to
   // minimize compatibility problems, but arbitrary UTF-16 strings are allowed
   // and will be attempted.
-  string16 username;
+  string16 username_;
 
   // The password to provide, possibly empty. This should be ASCII only to
   // minimize compatibility problems, but arbitrary UTF-16 strings are allowed
   // and will be attempted.
-  string16 password;
+  string16 password_;
 
   // Intentionally allowing the implicit copy constructor and assignment
   // operators.
diff --git a/net/base/zap.cc b/net/base/zap.cc
new file mode 100644
index 0000000..8bcf015
--- /dev/null
+++ b/net/base/zap.cc
@@ -0,0 +1,23 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/base/zap.h"
+
+namespace net {
+
+void ZapBuf(void* buf, size_t buf_len) {
+  memset(buf, 0x0, buf_len);
+}
+
+void ZapString(std::string* s) {
+  if (!s->empty())
+    ZapBuf(&(*s)[0], s->length() * sizeof(char));
+}
+
+void ZapString(string16* s) {
+  if (!s->empty())
+    ZapBuf(&(*s)[0], s->length() * sizeof(char16));
+}
+
+}  // net
diff --git a/net/base/zap.h b/net/base/zap.h
new file mode 100644
index 0000000..569b237
--- /dev/null
+++ b/net/base/zap.h
@@ -0,0 +1,28 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_BASE_ZAP_H_
+#define NET_BASE_ZAP_H_
+#pragma once
+
+#include <string>
+#include "base/string16.h"
+
+namespace net {
+
+// Zap functions are used to clear sensitive data in RAM to minimize the
+// time that people can access them once they are written to disk.
+
+// Overwrite a buffer  with 0's.
+void ZapBuf(void* buf, size_t buf_len);
+
+// Overwrite a string's internal buffer with 0's.
+void ZapString(std::string* s);
+
+// Overwrite a string16's internal buffer with 0's.
+void ZapString(string16* s);
+
+}  // net
+
+#endif  // NET_BASE_ZAP_H_
diff --git a/net/ftp/ftp_auth_cache.cc b/net/ftp/ftp_auth_cache.cc
index a67c2e0..fc28922 100644
--- a/net/ftp/ftp_auth_cache.cc
+++ b/net/ftp/ftp_auth_cache.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -13,11 +13,9 @@ namespace net {
 const size_t FtpAuthCache::kMaxEntries = 10;
 
 FtpAuthCache::Entry::Entry(const GURL& origin,
-                           const string16& username,
-                           const string16& password)
+                           const AuthCredentials& credentials)
     : origin(origin),
-      username(username),
-      password(password) {
+      credentials(credentials) {
 }
 
 FtpAuthCache::Entry::~Entry() {}
@@ -34,17 +32,15 @@ FtpAuthCache::Entry* FtpAuthCache::Lookup(const GURL& origin) {
   return NULL;
 }
 
-void FtpAuthCache::Add(const GURL& origin, const string16& username,
-                       const string16& password) {
+void FtpAuthCache::Add(const GURL& origin, const AuthCredentials& credentials) {
   DCHECK(origin.SchemeIs("ftp"));
   DCHECK_EQ(origin.GetOrigin(), origin);
 
   Entry* entry = Lookup(origin);
   if (entry) {
-    entry->username = username;
-    entry->password = password;
+    entry->credentials = credentials;
   } else {
-    entries_.push_front(Entry(origin, username, password));
+    entries_.push_front(Entry(origin, credentials));
 
     // Prevent unbound memory growth of the cache.
     if (entries_.size() > kMaxEntries)
@@ -52,11 +48,10 @@ void FtpAuthCache::Add(const GURL& origin, const string16& username,
   }
 }
 
-void FtpAuthCache::Remove(const GURL& origin, const string16& username,
-                          const string16& password) {
+void FtpAuthCache::Remove(const GURL& origin,
+                          const AuthCredentials& credentials) {
   for (EntryList::iterator it = entries_.begin(); it != entries_.end(); ++it) {
-    if (it->origin == origin && it->username == username &&
-        it->password == password) {
+    if (it->origin == origin && it->credentials.Equals(credentials)) {
       entries_.erase(it);
       DCHECK(!Lookup(origin));
       return;
diff --git a/net/ftp/ftp_auth_cache.h b/net/ftp/ftp_auth_cache.h
index 6281f9d..393b23d 100644
--- a/net/ftp/ftp_auth_cache.h
+++ b/net/ftp/ftp_auth_cache.h
@@ -8,8 +8,8 @@
 
 #include <list>
 
-#include "base/string16.h"
 #include "googleurl/src/gurl.h"
+#include "net/base/auth.h"
 #include "net/base/net_export.h"
 
 namespace net {
@@ -28,13 +28,11 @@ class NET_EXPORT_PRIVATE FtpAuthCache {
   static const size_t kMaxEntries;
 
   struct Entry {
-    Entry(const GURL& origin, const string16& username,
-          const string16& password);
+    Entry(const GURL& origin, const AuthCredentials& credentials);
     ~Entry();
 
     const GURL origin;
-    string16 username;
-    string16 password;
+    AuthCredentials credentials;
   };
 
   FtpAuthCache();
@@ -43,16 +41,13 @@ class NET_EXPORT_PRIVATE FtpAuthCache {
   // Return Entry corresponding to given |origin| or NULL if not found.
   Entry* Lookup(const GURL& origin);
 
-  // Add an entry for |origin| to the cache (consisting of |username| and
-  // |password|). If there is already an entry for |origin|, it will be
-  // overwritten.
-  void Add(const GURL& origin, const string16& username,
-           const string16& password);
+  // Add an entry for |origin| to the cache using |credentials|. If there is
+  // already an entry for |origin|, it will be overwritten.
+  void Add(const GURL& origin, const AuthCredentials& credentials);
 
   // Remove the entry for |origin| from the cache, if one exists and matches
-  // |username| and |password|.
-  void Remove(const GURL& origin, const string16& username,
-              const string16& password);
+  // |credentials|.
+  void Remove(const GURL& origin, const AuthCredentials& credentials);
 
  private:
   typedef std::list<Entry> EntryList;
diff --git a/net/ftp/ftp_auth_cache_unittest.cc b/net/ftp/ftp_auth_cache_unittest.cc
index a8c5732..33ce553 100644
--- a/net/ftp/ftp_auth_cache_unittest.cc
+++ b/net/ftp/ftp_auth_cache_unittest.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -8,6 +8,7 @@
 #include "base/string_util.h"
 #include "base/utf_string_conversions.h"
 #include "googleurl/src/gurl.h"
+#include "net/base/auth.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using net::FtpAuthCache;
@@ -38,38 +39,38 @@ TEST(FtpAuthCacheTest, LookupAddRemove) {
   EXPECT_TRUE(cache.Lookup(origin1) == NULL);
 
   // Add entry for origin1.
-  cache.Add(origin1, kUsername1, kPassword1);
+  cache.Add(origin1, net::AuthCredentials(kUsername1, kPassword1));
   FtpAuthCache::Entry* entry1 = cache.Lookup(origin1);
   ASSERT_TRUE(entry1);
   EXPECT_EQ(origin1, entry1->origin);
-  EXPECT_EQ(kUsername1, entry1->username);
-  EXPECT_EQ(kPassword1, entry1->password);
+  EXPECT_EQ(kUsername1, entry1->credentials.username());
+  EXPECT_EQ(kPassword1, entry1->credentials.password());
 
   // Add an entry for origin2.
-  cache.Add(origin2, kUsername2, kPassword2);
+  cache.Add(origin2, net::AuthCredentials(kUsername2, kPassword2));
   FtpAuthCache::Entry* entry2 = cache.Lookup(origin2);
   ASSERT_TRUE(entry2);
   EXPECT_EQ(origin2, entry2->origin);
-  EXPECT_EQ(kUsername2, entry2->username);
-  EXPECT_EQ(kPassword2, entry2->password);
+  EXPECT_EQ(kUsername2, entry2->credentials.username());
+  EXPECT_EQ(kPassword2, entry2->credentials.password());
 
   // The original entry1 should still be there.
   EXPECT_EQ(entry1, cache.Lookup(origin1));
 
   // Overwrite the entry for origin1.
-  cache.Add(origin1, kUsername3, kPassword3);
+  cache.Add(origin1, net::AuthCredentials(kUsername3, kPassword3));
   FtpAuthCache::Entry* entry3 = cache.Lookup(origin1);
   ASSERT_TRUE(entry3);
   EXPECT_EQ(origin1, entry3->origin);
-  EXPECT_EQ(kUsername3, entry3->username);
-  EXPECT_EQ(kPassword3, entry3->password);
+  EXPECT_EQ(kUsername3, entry3->credentials.username());
+  EXPECT_EQ(kPassword3, entry3->credentials.password());
 
   // Remove entry of origin1.
-  cache.Remove(origin1, kUsername3, kPassword3);
+  cache.Remove(origin1, net::AuthCredentials(kUsername3, kPassword3));
   EXPECT_TRUE(cache.Lookup(origin1) == NULL);
 
   // Remove non-existent entry.
-  cache.Remove(origin1, kUsername3, kPassword3);
+  cache.Remove(origin1, net::AuthCredentials(kUsername3, kPassword3));
   EXPECT_TRUE(cache.Lookup(origin1) == NULL);
 }
 
@@ -81,8 +82,8 @@ TEST(FtpAuthCacheTest, LookupWithPort) {
   GURL origin1("ftp://foo:80");
   GURL origin2("ftp://foo:21");
 
-  cache.Add(origin1, kUsername, kPassword);
-  cache.Add(origin2, kUsername, kPassword);
+  cache.Add(origin1, net::AuthCredentials(kUsername, kPassword));
+  cache.Add(origin2, net::AuthCredentials(kUsername, kPassword));
 
   EXPECT_NE(cache.Lookup(origin1), cache.Lookup(origin2));
 }
@@ -95,7 +96,7 @@ TEST(FtpAuthCacheTest, NormalizedKey) {
   FtpAuthCache cache;
 
   // Add.
-  cache.Add(GURL("ftp://HoSt:21"), kUsername, kPassword);
+  cache.Add(GURL("ftp://HoSt:21"), net::AuthCredentials(kUsername, kPassword));
 
   // Lookup.
   FtpAuthCache::Entry* entry1 = cache.Lookup(GURL("ftp://HoSt:21"));
@@ -104,30 +105,31 @@ TEST(FtpAuthCacheTest, NormalizedKey) {
   EXPECT_EQ(entry1, cache.Lookup(GURL("ftp://host")));
 
   // Overwrite.
-  cache.Add(GURL("ftp://host"), kOthername, kOtherword);
+  cache.Add(GURL("ftp://host"), net::AuthCredentials(kOthername, kOtherword));
   FtpAuthCache::Entry* entry2 = cache.Lookup(GURL("ftp://HoSt:21"));
   ASSERT_TRUE(entry2);
   EXPECT_EQ(GURL("ftp://host"), entry2->origin);
-  EXPECT_EQ(kOthername, entry2->username);
-  EXPECT_EQ(kOtherword, entry2->password);
+  EXPECT_EQ(kOthername, entry2->credentials.username());
+  EXPECT_EQ(kOtherword, entry2->credentials.password());
 
   // Remove
-  cache.Remove(GURL("ftp://HOsT"), kOthername, kOtherword);
+  cache.Remove(GURL("ftp://HOsT"),
+               net::AuthCredentials(kOthername, kOtherword));
   EXPECT_TRUE(cache.Lookup(GURL("ftp://host")) == NULL);
 }
 
 TEST(FtpAuthCacheTest, OnlyRemoveMatching) {
   FtpAuthCache cache;
 
-  cache.Add(GURL("ftp://host"), kUsername, kPassword);
+  cache.Add(GURL("ftp://host"), net::AuthCredentials(kUsername, kPassword));
   EXPECT_TRUE(cache.Lookup(GURL("ftp://host")));
 
   // Auth data doesn't match, shouldn't remove.
-  cache.Remove(GURL("ftp://host"), kBogus, kBogus);
+  cache.Remove(GURL("ftp://host"), net::AuthCredentials(kBogus, kBogus));
   EXPECT_TRUE(cache.Lookup(GURL("ftp://host")));
 
   // Auth data matches, should remove.
-  cache.Remove(GURL("ftp://host"), kUsername, kPassword);
+  cache.Remove(GURL("ftp://host"), net::AuthCredentials(kUsername, kPassword));
   EXPECT_TRUE(cache.Lookup(GURL("ftp://host")) == NULL);
 }
 
@@ -136,7 +138,7 @@ TEST(FtpAuthCacheTest, EvictOldEntries) {
 
   for (size_t i = 0; i < FtpAuthCache::kMaxEntries; i++) {
     cache.Add(GURL("ftp://host" + base::IntToString(i)),
-              kUsername, kPassword);
+              net::AuthCredentials(kUsername, kPassword));
   }
 
   // No entries should be evicted before reaching the limit.
@@ -145,7 +147,8 @@ TEST(FtpAuthCacheTest, EvictOldEntries) {
   }
 
   // Adding one entry should cause eviction of the first entry.
-  cache.Add(GURL("ftp://last_host"), kUsername, kPassword);
+  cache.Add(GURL("ftp://last_host"),
+            net::AuthCredentials(kUsername, kPassword));
   EXPECT_TRUE(cache.Lookup(GURL("ftp://host0")) == NULL);
 
   // Remaining entries should not get evicted.
diff --git a/net/ftp/ftp_network_transaction.cc b/net/ftp/ftp_network_transaction.cc
index d448ad3..24ab0f9 100644
--- a/net/ftp/ftp_network_transaction.cc
+++ b/net/ftp/ftp_network_transaction.cc
@@ -248,10 +248,13 @@ int FtpNetworkTransaction::Start(const FtpRequestInfo* request_info,
   request_ = request_info;
 
   if (request_->url.has_username()) {
-    GetIdentityFromURL(request_->url, &username_, &password_);
+    string16 username;
+    string16 password;
+    GetIdentityFromURL(request_->url, &username, &password);
+    credentials_.Set(username, password);
   } else {
-    username_ = ASCIIToUTF16("anonymous");
-    password_ = ASCIIToUTF16("chrome@example.com");
+    credentials_.Set(ASCIIToUTF16("anonymous"),
+                     ASCIIToUTF16("chrome@example.com"));
   }
 
   DetectTypecode();
@@ -263,13 +266,11 @@ int FtpNetworkTransaction::Start(const FtpRequestInfo* request_info,
   return rv;
 }
 
-int FtpNetworkTransaction::RestartWithAuth(const string16& username,
-                                           const string16& password,
+int FtpNetworkTransaction::RestartWithAuth(const AuthCredentials& credentials,
                                            OldCompletionCallback* callback) {
   ResetStateForRestart();
 
-  username_ = username;
-  password_ = password;
+  credentials_ = credentials;
 
   next_state_ = STATE_CTRL_RESOLVE_HOST;
   int rv = DoLoop(OK);
@@ -668,8 +669,10 @@ int FtpNetworkTransaction::DoCtrlReadComplete(int result) {
     // Some servers (for example Pure-FTPd) apparently close the control
     // connection when anonymous login is not permitted. For more details
     // see http://crbug.com/25023.
-    if (command_sent_ == COMMAND_USER && username_ == ASCIIToUTF16("anonymous"))
+    if (command_sent_ == COMMAND_USER &&
+        credentials_.username() == ASCIIToUTF16("anonymous")) {
       response_.needs_auth = true;
+    }
     return Stop(ERR_EMPTY_RESPONSE);
   }
   if (result < 0)
@@ -715,7 +718,7 @@ int FtpNetworkTransaction::DoCtrlWriteComplete(int result) {
 
 // USER Command.
 int FtpNetworkTransaction::DoCtrlWriteUSER() {
-  std::string command = "USER " + UTF16ToUTF8(username_);
+  std::string command = "USER " + UTF16ToUTF8(credentials_.username());
 
   if (!IsValidFTPCommandString(command))
     return Stop(ERR_MALFORMED_IDENTITY);
@@ -746,7 +749,7 @@ int FtpNetworkTransaction::ProcessResponseUSER(
 
 // PASS command.
 int FtpNetworkTransaction::DoCtrlWritePASS() {
-  std::string command = "PASS " + UTF16ToUTF8(password_);
+  std::string command = "PASS " + UTF16ToUTF8(credentials_.password());
 
   if (!IsValidFTPCommandString(command))
     return Stop(ERR_MALFORMED_IDENTITY);
diff --git a/net/ftp/ftp_network_transaction.h b/net/ftp/ftp_network_transaction.h
index cce5adb..7d32d55 100644
--- a/net/ftp/ftp_network_transaction.h
+++ b/net/ftp/ftp_network_transaction.h
@@ -12,8 +12,8 @@
 #include "base/compiler_specific.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
-#include "base/string16.h"
 #include "net/base/address_list.h"
+#include "net/base/auth.h"
 #include "net/base/host_resolver.h"
 #include "net/base/net_log.h"
 #include "net/base/single_request_host_resolver.h"
@@ -40,8 +40,7 @@ class NET_EXPORT_PRIVATE FtpNetworkTransaction : public FtpTransaction {
   virtual int Start(const FtpRequestInfo* request_info,
                     OldCompletionCallback* callback,
                     const BoundNetLog& net_log) OVERRIDE;
-  virtual int RestartWithAuth(const string16& username,
-                              const string16& password,
+  virtual int RestartWithAuth(const AuthCredentials& credentials,
                               OldCompletionCallback* callback) OVERRIDE;
   virtual int Read(IOBuffer* buf, int buf_len, OldCompletionCallback* callback)
       OVERRIDE;
@@ -232,8 +231,7 @@ class NET_EXPORT_PRIVATE FtpNetworkTransaction : public FtpTransaction {
   // EPSV fail, we fall back to PASV for the duration of connection.
   bool use_epsv_;
 
-  string16 username_;
-  string16 password_;
+  AuthCredentials credentials_;
 
   // Current directory on the remote server, as returned by last PWD command,
   // with any trailing slash removed.
diff --git a/net/ftp/ftp_network_transaction_unittest.cc b/net/ftp/ftp_network_transaction_unittest.cc
index 6739847..5d686e0 100644
--- a/net/ftp/ftp_network_transaction_unittest.cc
+++ b/net/ftp/ftp_network_transaction_unittest.cc
@@ -1190,9 +1190,11 @@ TEST_F(FtpNetworkTransactionTest, EvilRestartUser) {
                                         ctrl_writes, arraysize(ctrl_writes));
   mock_socket_factory_.AddSocketDataProvider(&ctrl_socket2);
   ASSERT_EQ(ERR_IO_PENDING,
-            transaction_.RestartWithAuth(ASCIIToUTF16("foo\nownz0red"),
-                                         ASCIIToUTF16("innocent"),
-                                         &callback_));
+            transaction_.RestartWithAuth(
+                AuthCredentials(
+                    ASCIIToUTF16("foo\nownz0red"),
+                    ASCIIToUTF16("innocent")),
+                &callback_));
   EXPECT_EQ(ERR_MALFORMED_IDENTITY, callback_.WaitForResult());
 }
 
@@ -1223,9 +1225,10 @@ TEST_F(FtpNetworkTransactionTest, EvilRestartPassword) {
                                         ctrl_writes, arraysize(ctrl_writes));
   mock_socket_factory_.AddSocketDataProvider(&ctrl_socket2);
   ASSERT_EQ(ERR_IO_PENDING,
-            transaction_.RestartWithAuth(ASCIIToUTF16("innocent"),
-                                         ASCIIToUTF16("foo\nownz0red"),
-                                         &callback_));
+            transaction_.RestartWithAuth(
+                AuthCredentials(ASCIIToUTF16("innocent"),
+                                ASCIIToUTF16("foo\nownz0red")),
+                &callback_));
   EXPECT_EQ(ERR_MALFORMED_IDENTITY, callback_.WaitForResult());
 }
 
diff --git a/net/ftp/ftp_transaction.h b/net/ftp/ftp_transaction.h
index 300468b..269c8bb 100644
--- a/net/ftp/ftp_transaction.h
+++ b/net/ftp/ftp_transaction.h
@@ -6,7 +6,6 @@
 #define NET_FTP_FTP_TRANSACTION_H_
 #pragma once
 
-#include "base/string16.h"
 #include "net/base/completion_callback.h"
 #include "net/base/io_buffer.h"
 #include "net/base/load_states.h"
@@ -14,6 +13,7 @@
 
 namespace net {
 
+class AuthCredentials;
 class FtpResponseInfo;
 class FtpRequestInfo;
 class BoundNetLog;
@@ -44,8 +44,7 @@ class NET_EXPORT_PRIVATE FtpTransaction {
                     const BoundNetLog& net_log) = 0;
 
   // Restarts the FTP transaction with authentication credentials.
-  virtual int RestartWithAuth(const string16& username,
-                              const string16& password,
+  virtual int RestartWithAuth(const AuthCredentials& credentials,
                               OldCompletionCallback* callback) = 0;
 
   // Once response info is available for the transaction, response data may be
diff --git a/net/http/http_auth.h b/net/http/http_auth.h
index 5140596c..7b71850 100644
--- a/net/http/http_auth.h
+++ b/net/http/http_auth.h
@@ -10,7 +10,7 @@
 #include <string>
 
 #include "base/memory/scoped_ptr.h"
-#include "base/string16.h"
+#include "net/base/auth.h"
 #include "net/base/net_export.h"
 #include "net/http/http_util.h"
 
@@ -104,8 +104,7 @@ class NET_EXPORT_PRIVATE HttpAuth {
 
     IdentitySource source;
     bool invalid;
-    string16 username;
-    string16 password;
+    AuthCredentials credentials;
   };
 
   // Get the name of the header containing the auth challenge
diff --git a/net/http/http_auth_cache.cc b/net/http/http_auth_cache.cc
index ac50cec..2cc2c0c 100644
--- a/net/http/http_auth_cache.cc
+++ b/net/http/http_auth_cache.cc
@@ -112,8 +112,7 @@ HttpAuthCache::Entry* HttpAuthCache::Add(const GURL& origin,
                                          const std::string& realm,
                                          HttpAuth::Scheme scheme,
                                          const std::string& auth_challenge,
-                                         const string16& username,
-                                         const string16& password,
+                                         const AuthCredentials& credentials,
                                          const std::string& path) {
   CheckOriginIsValid(origin);
   CheckPathIsValid(path);
@@ -138,8 +137,7 @@ HttpAuthCache::Entry* HttpAuthCache::Add(const GURL& origin,
   DCHECK_EQ(scheme, entry->scheme_);
 
   entry->auth_challenge_ = auth_challenge;
-  entry->username_ = username;
-  entry->password_ = password;
+  entry->credentials_ = credentials;
   entry->nonce_count_ = 1;
   entry->AddPath(path);
 
@@ -199,12 +197,11 @@ bool HttpAuthCache::Entry::HasEnclosingPath(const std::string& dir,
 bool HttpAuthCache::Remove(const GURL& origin,
                            const std::string& realm,
                            HttpAuth::Scheme scheme,
-                           const string16& username,
-                           const string16& password) {
+                           const AuthCredentials& credentials) {
   for (EntryList::iterator it = entries_.begin(); it != entries_.end(); ++it) {
     if (it->origin() == origin && it->realm() == realm &&
         it->scheme() == scheme) {
-      if (username == it->username() && password == it->password()) {
+      if (credentials.Equals(it->credentials())) {
         entries_.erase(it);
         return true;
       }
@@ -231,7 +228,7 @@ void HttpAuthCache::UpdateAllFrom(const HttpAuthCache& other) {
     // Add an Entry with one of the original entry's paths.
     DCHECK(it->paths_.size() > 0);
     Entry* entry = Add(it->origin(), it->realm(), it->scheme(),
-                       it->auth_challenge(), it->username(), it->password(),
+                       it->auth_challenge(), it->credentials(),
                        it->paths_.back());
     // Copy all other paths.
     for (Entry::PathList::const_reverse_iterator it2 = ++it->paths_.rbegin();
diff --git a/net/http/http_auth_cache.h b/net/http/http_auth_cache.h
index a5af644..3de2c71 100644
--- a/net/http/http_auth_cache.h
+++ b/net/http/http_auth_cache.h
@@ -11,7 +11,6 @@
 
 #include "base/gtest_prod_util.h"
 #include "base/memory/ref_counted.h"
-#include "base/string16.h"
 #include "googleurl/src/gurl.h"
 #include "net/base/net_export.h"
 #include "net/http/http_auth.h"
@@ -66,8 +65,7 @@ class NET_EXPORT_PRIVATE HttpAuthCache {
   //   |origin|   - the {scheme, host, port} of the server.
   //   |realm|    - the auth realm for the challenge.
   //   |scheme|   - the authentication scheme (i.e. basic, negotiate).
-  //   |username| - login information for the realm.
-  //   |password| - login information for the realm.
+  //   |credentials| - login information for the realm.
   //   |path|     - absolute path for a resource contained in the protection
   //                space; this will be added to the list of known paths.
   //   returns    - the entry that was just added/updated.
@@ -75,23 +73,20 @@ class NET_EXPORT_PRIVATE HttpAuthCache {
              const std::string& realm,
              HttpAuth::Scheme scheme,
              const std::string& auth_challenge,
-             const string16& username,
-             const string16& password,
+             const AuthCredentials& credentials,
              const std::string& path);
 
   // Remove entry on server |origin| for realm |realm| and scheme |scheme|
-  // if one exists AND if the cached identity matches (|username|, |password|).
+  // if one exists AND if the cached credentials matches |credentials|.
   //   |origin|   - the {scheme, host, port} of the server.
   //   |realm|    - case sensitive realm string.
   //   |scheme|   - the authentication scheme (i.e. basic, negotiate).
-  //   |username| - condition to match.
-  //   |password| - condition to match.
+  //   |credentials| - the credentials to match.
   //   returns    - true if an entry was removed.
   bool Remove(const GURL& origin,
               const std::string& realm,
               HttpAuth::Scheme scheme,
-              const string16& username,
-              const string16& password);
+              const AuthCredentials& credentials);
 
   // Updates a stale digest entry on server |origin| for realm |realm| and
   // scheme |scheme|. The cached auth challenge is replaced with
@@ -135,14 +130,9 @@ class NET_EXPORT_PRIVATE HttpAuthCache::Entry {
     return auth_challenge_;
   }
 
-  // The login username.
-  const string16 username() const {
-    return username_;
-  }
-
-  // The login password.
-  const string16 password() const {
-    return password_;
+  // The login credentials.
+  const AuthCredentials& credentials() const {
+    return credentials_;
   }
 
   int IncrementNonceCount() {
@@ -181,8 +171,7 @@ class NET_EXPORT_PRIVATE HttpAuthCache::Entry {
 
   // Identity.
   std::string auth_challenge_;
-  string16 username_;
-  string16 password_;
+  AuthCredentials credentials_;
 
   int nonce_count_;
 
diff --git a/net/http/http_auth_cache_unittest.cc b/net/http/http_auth_cache_unittest.cc
index 96bd2dd..cd1e5be 100644
--- a/net/http/http_auth_cache_unittest.cc
+++ b/net/http/http_auth_cache_unittest.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -40,8 +40,7 @@ class MockAuthHandler : public HttpAuthHandler {
     return false;  // Unused.
   }
 
-  virtual int GenerateAuthTokenImpl(const string16*,
-                                    const string16*,
+  virtual int GenerateAuthTokenImpl(const AuthCredentials*,
                                     const HttpRequestInfo*,
                                     OldCompletionCallback* callback,
                                     std::string* auth_token) {
@@ -69,6 +68,11 @@ const string16 kRoot(ASCIIToUTF16("root"));
 const string16 kUsername(ASCIIToUTF16("username"));
 const string16 kWileCoyote(ASCIIToUTF16("wilecoyote"));
 
+AuthCredentials CreateASCIICredentials(const char* username,
+                                       const char* password) {
+  return AuthCredentials(ASCIIToUTF16(username), ASCIIToUTF16(password));
+}
+
 }  // namespace
 
 // Test adding and looking-up cache entries (both by realm and by path).
@@ -85,16 +89,18 @@ TEST(HttpAuthCacheTest, Basic) {
                           kRealm1,
                           HttpAuth::AUTH_SERVER));
   cache.Add(origin, realm1_handler->realm(), realm1_handler->auth_scheme(),
-            "Basic realm=Realm1", ASCIIToUTF16("realm1-user"),
-            ASCIIToUTF16("realm1-password"), "/foo/bar/index.html");
+            "Basic realm=Realm1",
+            CreateASCIICredentials("realm1-user", "realm1-password"),
+            "/foo/bar/index.html");
 
   scoped_ptr<HttpAuthHandler> realm2_handler(
       new MockAuthHandler(HttpAuth::AUTH_SCHEME_BASIC,
                           kRealm2,
                           HttpAuth::AUTH_SERVER));
   cache.Add(origin, realm2_handler->realm(), realm2_handler->auth_scheme(),
-            "Basic realm=Realm2", ASCIIToUTF16("realm2-user"),
-            ASCIIToUTF16("realm2-password"), "/foo2/index.html");
+            "Basic realm=Realm2",
+            CreateASCIICredentials("realm2-user", "realm2-password"),
+            "/foo2/index.html");
 
   scoped_ptr<HttpAuthHandler> realm3_basic_handler(
       new MockAuthHandler(HttpAuth::AUTH_SCHEME_BASIC,
@@ -102,8 +108,9 @@ TEST(HttpAuthCacheTest, Basic) {
                           HttpAuth::AUTH_PROXY));
   cache.Add(origin, realm3_basic_handler->realm(),
             realm3_basic_handler->auth_scheme(), "Basic realm=Realm3",
-            ASCIIToUTF16("realm3-basic-user"),
-            ASCIIToUTF16("realm3-basic-password"), "");
+            CreateASCIICredentials("realm3-basic-user",
+                                   "realm3-basic-password"),
+            "");
 
   scoped_ptr<HttpAuthHandler> realm3_digest_handler(
       new MockAuthHandler(HttpAuth::AUTH_SCHEME_DIGEST,
@@ -111,8 +118,9 @@ TEST(HttpAuthCacheTest, Basic) {
                           HttpAuth::AUTH_PROXY));
   cache.Add(origin, realm3_digest_handler->realm(),
             realm3_digest_handler->auth_scheme(), "Digest realm=Realm3",
-            ASCIIToUTF16("realm3-digest-user"),
-            ASCIIToUTF16("realm3-digest-password"), "/baz/index.html");
+            CreateASCIICredentials("realm3-digest-user",
+                                   "realm3-digest-password"),
+            "/baz/index.html");
 
   scoped_ptr<HttpAuthHandler> realm4_basic_handler(
       new MockAuthHandler(HttpAuth::AUTH_SCHEME_BASIC,
@@ -120,8 +128,9 @@ TEST(HttpAuthCacheTest, Basic) {
                           HttpAuth::AUTH_SERVER));
   cache.Add(origin, realm4_basic_handler->realm(),
             realm4_basic_handler->auth_scheme(), "Basic realm=Realm4",
-            ASCIIToUTF16("realm4-basic-user"),
-            ASCIIToUTF16("realm4-basic-password"), "/");
+            CreateASCIICredentials("realm4-basic-user",
+                                   "realm4-basic-password"),
+            "/");
 
   // There is no Realm5
   entry = cache.Lookup(origin, kRealm5, HttpAuth::AUTH_SCHEME_BASIC);
@@ -144,8 +153,9 @@ TEST(HttpAuthCacheTest, Basic) {
   EXPECT_EQ(HttpAuth::AUTH_SCHEME_BASIC, entry->scheme());
   EXPECT_EQ(kRealm3, entry->realm());
   EXPECT_EQ("Basic realm=Realm3", entry->auth_challenge());
-  EXPECT_EQ(ASCIIToUTF16("realm3-basic-user"), entry->username());
-  EXPECT_EQ(ASCIIToUTF16("realm3-basic-password"), entry->password());
+  EXPECT_EQ(ASCIIToUTF16("realm3-basic-user"), entry->credentials().username());
+  EXPECT_EQ(ASCIIToUTF16("realm3-basic-password"),
+            entry->credentials().password());
 
   // Valid lookup by origin, realm, scheme when there's a duplicate
   // origin, realm in the cache
@@ -155,8 +165,10 @@ TEST(HttpAuthCacheTest, Basic) {
   EXPECT_EQ(HttpAuth::AUTH_SCHEME_DIGEST, entry->scheme());
   EXPECT_EQ(kRealm3, entry->realm());
   EXPECT_EQ("Digest realm=Realm3", entry->auth_challenge());
-  EXPECT_EQ(ASCIIToUTF16("realm3-digest-user"), entry->username());
-  EXPECT_EQ(ASCIIToUTF16("realm3-digest-password"), entry->password());
+  EXPECT_EQ(ASCIIToUTF16("realm3-digest-user"),
+            entry->credentials().username());
+  EXPECT_EQ(ASCIIToUTF16("realm3-digest-password"),
+            entry->credentials().password());
 
   // Valid lookup by realm.
   entry = cache.Lookup(origin, kRealm2, HttpAuth::AUTH_SCHEME_BASIC);
@@ -164,8 +176,8 @@ TEST(HttpAuthCacheTest, Basic) {
   EXPECT_EQ(HttpAuth::AUTH_SCHEME_BASIC, entry->scheme());
   EXPECT_EQ(kRealm2, entry->realm());
   EXPECT_EQ("Basic realm=Realm2", entry->auth_challenge());
-  EXPECT_EQ(ASCIIToUTF16("realm2-user"), entry->username());
-  EXPECT_EQ(ASCIIToUTF16("realm2-password"), entry->password());
+  EXPECT_EQ(ASCIIToUTF16("realm2-user"), entry->credentials().username());
+  EXPECT_EQ(ASCIIToUTF16("realm2-password"), entry->credentials().password());
 
   // Check that subpaths are recognized.
   HttpAuthCache::Entry* realm2_entry = cache.Lookup(
@@ -269,18 +281,18 @@ TEST(HttpAuthCacheTest, AddToExistingEntry) {
           HttpAuth::AUTH_SCHEME_BASIC, "MyRealm", HttpAuth::AUTH_SERVER));
   HttpAuthCache::Entry* orig_entry = cache.Add(
       origin, handler->realm(), handler->auth_scheme(), auth_challenge,
-      ASCIIToUTF16("user1"), ASCIIToUTF16("password1"), "/x/y/z/");
+      CreateASCIICredentials("user1", "password1"), "/x/y/z/");
   cache.Add(origin, handler->realm(), handler->auth_scheme(), auth_challenge,
-            ASCIIToUTF16("user2"), ASCIIToUTF16("password2"), "/z/y/x/");
+            CreateASCIICredentials("user2", "password2"), "/z/y/x/");
   cache.Add(origin, handler->realm(), handler->auth_scheme(), auth_challenge,
-            ASCIIToUTF16("user3"), ASCIIToUTF16("password3"), "/z/y");
+            CreateASCIICredentials("user3", "password3"), "/z/y");
 
   HttpAuthCache::Entry* entry = cache.Lookup(
       origin, "MyRealm", HttpAuth::AUTH_SCHEME_BASIC);
 
   EXPECT_TRUE(entry == orig_entry);
-  EXPECT_EQ(ASCIIToUTF16("user3"), entry->username());
-  EXPECT_EQ(ASCIIToUTF16("password3"), entry->password());
+  EXPECT_EQ(ASCIIToUTF16("user3"), entry->credentials().username());
+  EXPECT_EQ(ASCIIToUTF16("password3"), entry->credentials().password());
 
   EXPECT_EQ(2U, entry->paths_.size());
   EXPECT_EQ("/z/", entry->paths_.front());
@@ -308,58 +320,65 @@ TEST(HttpAuthCacheTest, Remove) {
 
   HttpAuthCache cache;
   cache.Add(origin, realm1_handler->realm(), realm1_handler->auth_scheme(),
-            "basic realm=Realm1", kAlice, k123, "/");
+            "basic realm=Realm1", AuthCredentials(kAlice, k123), "/");
   cache.Add(origin, realm2_handler->realm(), realm2_handler->auth_scheme(),
-            "basic realm=Realm2", ASCIIToUTF16("bob"), ASCIIToUTF16("princess"),
+            "basic realm=Realm2", CreateASCIICredentials("bob", "princess"),
             "/");
   cache.Add(origin, realm3_basic_handler->realm(),
             realm3_basic_handler->auth_scheme(), "basic realm=Realm3",
-            kAdmin, kPassword, "/");
+            AuthCredentials(kAdmin, kPassword), "/");
   cache.Add(origin, realm3_digest_handler->realm(),
             realm3_digest_handler->auth_scheme(), "digest realm=Realm3",
-            kRoot, kWileCoyote, "/");
+            AuthCredentials(kRoot, kWileCoyote), "/");
 
   // Fails, because there is no realm "Realm5".
   EXPECT_FALSE(cache.Remove(
-      origin, kRealm5, HttpAuth::AUTH_SCHEME_BASIC, kAlice, k123));
+      origin, kRealm5, HttpAuth::AUTH_SCHEME_BASIC,
+      AuthCredentials(kAlice, k123)));
 
   // Fails because the origin is wrong.
   EXPECT_FALSE(cache.Remove(GURL("http://foobar2.com:100"),
                             kRealm1,
                             HttpAuth::AUTH_SCHEME_BASIC,
-                            kAlice,
-                            k123));
+                            AuthCredentials(kAlice, k123)));
 
   // Fails because the username is wrong.
   EXPECT_FALSE(cache.Remove(
-      origin, kRealm1, HttpAuth::AUTH_SCHEME_BASIC, kAlice2, k123));
+      origin, kRealm1, HttpAuth::AUTH_SCHEME_BASIC,
+      AuthCredentials(kAlice2, k123)));
 
   // Fails because the password is wrong.
   EXPECT_FALSE(cache.Remove(
-      origin, kRealm1, HttpAuth::AUTH_SCHEME_BASIC, kAlice, k1234));
+      origin, kRealm1, HttpAuth::AUTH_SCHEME_BASIC,
+      AuthCredentials(kAlice, k1234)));
 
   // Fails because the authentication type is wrong.
   EXPECT_FALSE(cache.Remove(
-      origin, kRealm1, HttpAuth::AUTH_SCHEME_DIGEST, kAlice, k123));
+      origin, kRealm1, HttpAuth::AUTH_SCHEME_DIGEST,
+      AuthCredentials(kAlice, k123)));
 
   // Succeeds.
   EXPECT_TRUE(cache.Remove(
-      origin, kRealm1, HttpAuth::AUTH_SCHEME_BASIC, kAlice, k123));
+      origin, kRealm1, HttpAuth::AUTH_SCHEME_BASIC,
+      AuthCredentials(kAlice, k123)));
 
   // Fails because we just deleted the entry!
   EXPECT_FALSE(cache.Remove(
-      origin, kRealm1, HttpAuth::AUTH_SCHEME_BASIC, kAlice, k123));
+      origin, kRealm1, HttpAuth::AUTH_SCHEME_BASIC,
+      AuthCredentials(kAlice, k123)));
 
   // Succeed when there are two authentication types for the same origin,realm.
   EXPECT_TRUE(cache.Remove(
-      origin, kRealm3, HttpAuth::AUTH_SCHEME_DIGEST, kRoot, kWileCoyote));
+      origin, kRealm3, HttpAuth::AUTH_SCHEME_DIGEST,
+      AuthCredentials(kRoot, kWileCoyote)));
 
   // Succeed as above, but when entries were added in opposite order
   cache.Add(origin, realm3_digest_handler->realm(),
             realm3_digest_handler->auth_scheme(), "digest realm=Realm3",
-            kRoot, kWileCoyote, "/");
+            AuthCredentials(kRoot, kWileCoyote), "/");
   EXPECT_TRUE(cache.Remove(
-      origin, kRealm3, HttpAuth::AUTH_SCHEME_BASIC, kAdmin, kPassword));
+      origin, kRealm3, HttpAuth::AUTH_SCHEME_BASIC,
+      AuthCredentials(kAdmin, kPassword)));
 
   // Make sure that removing one entry still leaves the other available for
   // lookup.
@@ -380,8 +399,7 @@ TEST(HttpAuthCacheTest, UpdateStaleChallenge) {
       digest_handler->auth_scheme(),
       "Digest realm=Realm1,"
       "nonce=\"s3MzvFhaBAA=4c520af5acd9d8d7ae26947529d18c8eae1e98f4\"",
-      ASCIIToUTF16("realm-digest-user"),
-      ASCIIToUTF16("realm-digest-password"),
+      CreateASCIICredentials("realm-digest-user", "realm-digest-password"),
       "/baz/index.html");
   ASSERT_TRUE(entry_pre != NULL);
 
@@ -444,17 +462,17 @@ TEST(HttpAuthCacheTest, UpdateAllFrom) {
 
   first_cache.Add(origin, realm1_handler->realm(),
                   realm1_handler->auth_scheme(), "basic realm=Realm1",
-                  kAlice, k123, path);
+                  AuthCredentials(kAlice, k123), path);
   first_cache.Add(origin, realm2_handler->realm(),
                   realm2_handler->auth_scheme(), "basic realm=Realm2",
-                  kAlice2, k1234, path);
+                  AuthCredentials(kAlice2, k1234), path);
   first_cache.Add(origin, realm3_digest_handler->realm(),
                   realm3_digest_handler->auth_scheme(), "digest realm=Realm3",
-                  kRoot, kWileCoyote, path);
+                  AuthCredentials(kRoot, kWileCoyote), path);
   entry = first_cache.Add(
       origin, realm3_digest_handler->realm(),
       realm3_digest_handler->auth_scheme(), "digest realm=Realm3",
-      kRoot, kWileCoyote, another_path);
+      AuthCredentials(kRoot, kWileCoyote), another_path);
 
   EXPECT_EQ(2, entry->IncrementNonceCount());
 
@@ -462,45 +480,45 @@ TEST(HttpAuthCacheTest, UpdateAllFrom) {
   // Will be overwritten by kRoot:kWileCoyote.
   second_cache.Add(origin, realm3_digest_handler->realm(),
                    realm3_digest_handler->auth_scheme(), "digest realm=Realm3",
-                   kAlice2, k1234, path);
+                   AuthCredentials(kAlice2, k1234), path);
   // Should be left intact.
   second_cache.Add(origin, realm4_handler->realm(),
                    realm4_handler->auth_scheme(), "basic realm=Realm4",
-                   kAdmin, kRoot, path);
+                   AuthCredentials(kAdmin, kRoot), path);
 
   second_cache.UpdateAllFrom(first_cache);
 
   // Copied from first_cache.
   entry = second_cache.Lookup(origin, kRealm1, HttpAuth::AUTH_SCHEME_BASIC);
   EXPECT_TRUE(NULL != entry);
-  EXPECT_EQ(kAlice, entry->username());
-  EXPECT_EQ(k123, entry->password());
+  EXPECT_EQ(kAlice, entry->credentials().username());
+  EXPECT_EQ(k123, entry->credentials().password());
 
   // Copied from first_cache.
   entry = second_cache.Lookup(origin, kRealm2, HttpAuth::AUTH_SCHEME_BASIC);
   EXPECT_TRUE(NULL != entry);
-  EXPECT_EQ(kAlice2, entry->username());
-  EXPECT_EQ(k1234, entry->password());
+  EXPECT_EQ(kAlice2, entry->credentials().username());
+  EXPECT_EQ(k1234, entry->credentials().password());
 
   // Overwritten from first_cache.
   entry = second_cache.Lookup(origin, kRealm3, HttpAuth::AUTH_SCHEME_DIGEST);
   EXPECT_TRUE(NULL != entry);
-  EXPECT_EQ(kRoot, entry->username());
-  EXPECT_EQ(kWileCoyote, entry->password());
+  EXPECT_EQ(kRoot, entry->credentials().username());
+  EXPECT_EQ(kWileCoyote, entry->credentials().password());
   // Nonce count should get copied.
   EXPECT_EQ(3, entry->IncrementNonceCount());
 
   // All paths should get copied.
   entry = second_cache.LookupByPath(origin, another_path);
   EXPECT_TRUE(NULL != entry);
-  EXPECT_EQ(kRoot, entry->username());
-  EXPECT_EQ(kWileCoyote, entry->password());
+  EXPECT_EQ(kRoot, entry->credentials().username());
+  EXPECT_EQ(kWileCoyote, entry->credentials().password());
 
   // Left intact in second_cache.
   entry = second_cache.Lookup(origin, kRealm4, HttpAuth::AUTH_SCHEME_BASIC);
   EXPECT_TRUE(NULL != entry);
-  EXPECT_EQ(kAdmin, entry->username());
-  EXPECT_EQ(kRoot, entry->password());
+  EXPECT_EQ(kAdmin, entry->credentials().username());
+  EXPECT_EQ(kRoot, entry->credentials().password());
 }
 
 // Test fixture class for eviction tests (contains helpers for bulk
@@ -523,7 +541,8 @@ class HttpAuthCacheEvictionTest : public testing::Test {
 
   void AddPathToRealm(int realm_i, int path_i) {
     cache_.Add(origin_, GenerateRealm(realm_i), HttpAuth::AUTH_SCHEME_BASIC, "",
-               kUsername, kPassword, GeneratePath(realm_i, path_i));
+               AuthCredentials(kUsername, kPassword),
+               GeneratePath(realm_i, path_i));
   }
 
   void CheckRealmExistence(int realm_i, bool exists) {
diff --git a/net/http/http_auth_controller.cc b/net/http/http_auth_controller.cc
index d0ff551..49f61bc 100644
--- a/net/http/http_auth_controller.cc
+++ b/net/http/http_auth_controller.cc
@@ -179,16 +179,12 @@ int HttpAuthController::MaybeGenerateAuthToken(const HttpRequestInfo* request,
   bool needs_auth = HaveAuth() || SelectPreemptiveAuth(net_log);
   if (!needs_auth)
     return OK;
-  const string16* username = NULL;
-  const string16* password = NULL;
-  if (identity_.source != HttpAuth::IDENT_SRC_DEFAULT_CREDENTIALS) {
-    username = &identity_.username;
-    password = &identity_.password;
-  }
+  const AuthCredentials* credentials = NULL;
+  if (identity_.source != HttpAuth::IDENT_SRC_DEFAULT_CREDENTIALS)
+    credentials = &identity_.credentials;
   DCHECK(auth_token_.empty());
   DCHECK(NULL == user_callback_);
-  int rv = handler_->GenerateAuthToken(username,
-                                       password,
+  int rv = handler_->GenerateAuthToken(credentials,
                                        request,
                                        &io_callback_,
                                        &auth_token_);
@@ -206,7 +202,7 @@ bool HttpAuthController::SelectPreemptiveAuth(const BoundNetLog& net_log) {
   DCHECK(!HaveAuth());
   DCHECK(identity_.invalid);
 
-  // Don't do preemptive authorization if the URL contains a username/password,
+  // Don't do preemptive authorization if the URL contains a username:password,
   // since we must first be challenged in order to use the URL's identity.
   if (auth_url_.has_username())
     return false;
@@ -233,8 +229,7 @@ bool HttpAuthController::SelectPreemptiveAuth(const BoundNetLog& net_log) {
   // Set the state
   identity_.source = HttpAuth::IDENT_SRC_PATH_LOOKUP;
   identity_.invalid = false;
-  identity_.username = entry->username();
-  identity_.password = entry->password();
+  identity_.credentials = entry->credentials();
   handler_.swap(handler_preemptive);
   return true;
 }
@@ -381,17 +376,15 @@ int HttpAuthController::HandleAuthChallenge(
   return OK;
 }
 
-void HttpAuthController::ResetAuth(const string16& username,
-                                   const string16& password) {
+void HttpAuthController::ResetAuth(const AuthCredentials& credentials) {
   DCHECK(CalledOnValidThread());
-  DCHECK(identity_.invalid || (username.empty() && password.empty()));
+  DCHECK(identity_.invalid || credentials.Empty());
 
   if (identity_.invalid) {
-    // Update the username/password.
+    // Update the credentials.
     identity_.source = HttpAuth::IDENT_SRC_EXTERNAL;
     identity_.invalid = false;
-    identity_.username = username;
-    identity_.password = password;
+    identity_.credentials = credentials;
   }
 
   DCHECK(identity_.source != HttpAuth::IDENT_SRC_PATH_LOOKUP);
@@ -417,8 +410,7 @@ void HttpAuthController::ResetAuth(const string16& username,
     default:
       http_auth_cache_->Add(auth_origin_, handler_->realm(),
                             handler_->auth_scheme(), handler_->challenge(),
-                            identity_.username, identity_.password,
-                            auth_path_);
+                            identity_.credentials, auth_path_);
       break;
   }
 }
@@ -449,11 +441,10 @@ void HttpAuthController::InvalidateRejectedAuthFromCache() {
   DCHECK(HaveAuth());
 
   // Clear the cache entry for the identity we just failed on.
-  // Note: we require the username/password to match before invalidating
+  // Note: we require the credentials to match before invalidating
   // since the entry in the cache may be newer than what we used last time.
   http_auth_cache_->Remove(auth_origin_, handler_->realm(),
-                           handler_->auth_scheme(), identity_.username,
-                           identity_.password);
+                           handler_->auth_scheme(), identity_.credentials);
 }
 
 bool HttpAuthController::SelectNextAuthIdentityToTry() {
@@ -461,15 +452,16 @@ bool HttpAuthController::SelectNextAuthIdentityToTry() {
   DCHECK(handler_.get());
   DCHECK(identity_.invalid);
 
-  // Try to use the username/password encoded into the URL first.
+  // Try to use the username:password encoded into the URL first.
   if (target_ == HttpAuth::AUTH_SERVER && auth_url_.has_username() &&
       !embedded_identity_used_) {
     identity_.source = HttpAuth::IDENT_SRC_URL;
     identity_.invalid = false;
     // Extract the username:password from the URL.
-    GetIdentityFromURL(auth_url_,
-                       &identity_.username,
-                       &identity_.password);
+    string16 username;
+    string16 password;
+    GetIdentityFromURL(auth_url_, &username, &password);
+    identity_.credentials.Set(username, password);
     embedded_identity_used_ = true;
     // TODO(eroman): If the password is blank, should we also try combining
     // with a password from the cache?
@@ -484,8 +476,7 @@ bool HttpAuthController::SelectNextAuthIdentityToTry() {
   if (entry) {
     identity_.source = HttpAuth::IDENT_SRC_REALM_LOOKUP;
     identity_.invalid = false;
-    identity_.username = entry->username();
-    identity_.password = entry->password();
+    identity_.credentials = entry->credentials();
     return true;
   }
 
diff --git a/net/http/http_auth_controller.h b/net/http/http_auth_controller.h
index 45a1339..2712d00 100644
--- a/net/http/http_auth_controller.h
+++ b/net/http/http_auth_controller.h
@@ -12,7 +12,6 @@
 #include "base/basictypes.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
-#include "base/string16.h"
 #include "base/threading/non_thread_safe.h"
 #include "googleurl/src/gurl.h"
 #include "net/base/completion_callback.h"
@@ -23,6 +22,7 @@
 namespace net {
 
 class AuthChallengeInfo;
+class AuthCredentials;
 class HttpAuthHandler;
 class HttpAuthHandlerFactory;
 class HttpAuthCache;
@@ -62,8 +62,7 @@ class NET_EXPORT_PRIVATE HttpAuthController
                                   const BoundNetLog& net_log);
 
   // Store the supplied credentials and prepare to restart the auth.
-  virtual void ResetAuth(const string16& username,
-                         const string16& password);
+  virtual void ResetAuth(const AuthCredentials& credentials);
 
   virtual bool HaveAuthHandler() const;
 
@@ -107,7 +106,7 @@ class NET_EXPORT_PRIVATE HttpAuthController
   bool SelectNextAuthIdentityToTry();
 
   // Populates auth_info_ with the challenge information, so that
-  // URLRequestHttpJob can prompt for a username/password.
+  // URLRequestHttpJob can prompt for credentials.
   void PopulateAuthChallenge();
 
   // If |result| indicates a permanent failure, disables the current
@@ -135,8 +134,8 @@ class NET_EXPORT_PRIVATE HttpAuthController
   // associated auth handler.
   scoped_ptr<HttpAuthHandler> handler_;
 
-  // |identity_| holds the (username/password) that should be used by
-  // the handler_ to generate credentials. This identity can come from
+  // |identity_| holds the credentials that should be used by
+  // the handler_ to generate challenge responses. This identity can come from
   // a number of places (url, cache, prompt).
   HttpAuth::Identity identity_;
 
@@ -147,7 +146,7 @@ class NET_EXPORT_PRIVATE HttpAuthController
   // Contains information about the auth challenge.
   scoped_refptr<AuthChallengeInfo> auth_info_;
 
-  // True if we've used the username/password embedded in the URL.  This
+  // True if we've used the username:password embedded in the URL.  This
   // makes sure we use the embedded identity only once for the transaction,
   // preventing an infinite auth restart loop.
   bool embedded_identity_used_;
diff --git a/net/http/http_auth_controller_unittest.cc b/net/http/http_auth_controller_unittest.cc
index d1c82dc..392d9ab 100644
--- a/net/http/http_auth_controller_unittest.cc
+++ b/net/http/http_auth_controller_unittest.cc
@@ -74,7 +74,7 @@ void RunSingleRoundAuthTest(HandlerRunMode run_mode,
   ASSERT_EQ(OK,
             controller->HandleAuthChallenge(headers, false, false, dummy_log));
   ASSERT_TRUE(controller->HaveAuthHandler());
-  controller->ResetAuth(string16(), string16());
+  controller->ResetAuth(AuthCredentials());
   EXPECT_TRUE(controller->HaveAuth());
 
   TestOldCompletionCallback callback;
@@ -142,17 +142,17 @@ TEST(HttpAuthControllerTest, NoExplicitCredentialsAllowed) {
       return true;
     }
 
-    virtual int GenerateAuthTokenImpl(const string16* username,
-                                      const string16* password,
+    virtual int GenerateAuthTokenImpl(const AuthCredentials* credentials,
                                       const HttpRequestInfo* request,
                                       OldCompletionCallback* callback,
                                       std::string* auth_token) OVERRIDE {
       int result =
-          HttpAuthHandlerMock::GenerateAuthTokenImpl(username, password,
+          HttpAuthHandlerMock::GenerateAuthTokenImpl(credentials,
                                                      request, callback,
                                                      auth_token);
       EXPECT_TRUE(result != OK ||
-                  !AllowsExplicitCredentials() || !username->empty());
+                  !AllowsExplicitCredentials() ||
+                  !credentials->Empty());
       return result;
     }
 
@@ -211,7 +211,7 @@ TEST(HttpAuthControllerTest, NoExplicitCredentialsAllowed) {
   ASSERT_EQ(OK,
             controller->HandleAuthChallenge(headers, false, false, dummy_log));
   ASSERT_TRUE(controller->HaveAuthHandler());
-  controller->ResetAuth(string16(), string16());
+  controller->ResetAuth(AuthCredentials());
   EXPECT_TRUE(controller->HaveAuth());
 
   // Should only succeed if we are using the AUTH_SCHEME_MOCK MockHandler.
@@ -223,7 +223,7 @@ TEST(HttpAuthControllerTest, NoExplicitCredentialsAllowed) {
   ASSERT_EQ(OK,
             controller->HandleAuthChallenge(headers, false, false, dummy_log));
   ASSERT_TRUE(controller->HaveAuthHandler());
-  controller->ResetAuth(ASCIIToUTF16("Hello"), string16());
+  controller->ResetAuth(AuthCredentials(ASCIIToUTF16("Hello"), string16()));
   EXPECT_TRUE(controller->HaveAuth());
   EXPECT_TRUE(controller->IsAuthSchemeDisabled(HttpAuth::AUTH_SCHEME_MOCK));
   EXPECT_FALSE(controller->IsAuthSchemeDisabled(HttpAuth::AUTH_SCHEME_BASIC));
diff --git a/net/http/http_auth_gssapi_posix.cc b/net/http/http_auth_gssapi_posix.cc
index aff2ac1..46dddbf 100644
--- a/net/http/http_auth_gssapi_posix.cc
+++ b/net/http/http_auth_gssapi_posix.cc
@@ -723,12 +723,10 @@ HttpAuth::AuthorizationResult HttpAuthGSSAPI::ParseChallenge(
   return HttpAuth::AUTHORIZATION_RESULT_ACCEPT;
 }
 
-int HttpAuthGSSAPI::GenerateAuthToken(const string16* username,
-                                      const string16* password,
+int HttpAuthGSSAPI::GenerateAuthToken(const AuthCredentials* credentials,
                                       const std::wstring& spn,
                                       std::string* auth_token) {
   DCHECK(auth_token);
-  DCHECK(username == NULL && password == NULL);
 
   gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
   input_token.length = decoded_server_auth_token_.length();
diff --git a/net/http/http_auth_gssapi_posix.h b/net/http/http_auth_gssapi_posix.h
index 3367713..ecf057a 100644
--- a/net/http/http_auth_gssapi_posix.h
+++ b/net/http/http_auth_gssapi_posix.h
@@ -12,7 +12,6 @@
 
 #include "base/gtest_prod_util.h"
 #include "base/native_library.h"
-#include "base/string16.h"
 #include "net/base/net_export.h"
 #include "net/http/http_auth.h"
 
@@ -245,10 +244,9 @@ class NET_EXPORT_PRIVATE HttpAuthGSSAPI {
   // |spn| is the Service Principal Name of the server that the token is
   // being generated for.
   // If this is the first round of a multiple round scheme, credentials are
-  // obtained using |*username| and |*password|. If |username| and |password|
-  // are NULL, the default credentials are used instead.
-  int GenerateAuthToken(const string16* username,
-                        const string16* password,
+  // obtained using |*credentials|. If |credentials| is NULL, the default
+  // credentials are used instead.
+  int GenerateAuthToken(const AuthCredentials* credentials,
                         const std::wstring& spn,
                         std::string* auth_token);
 
diff --git a/net/http/http_auth_gssapi_posix_unittest.cc b/net/http/http_auth_gssapi_posix_unittest.cc
index f536ee8..8a16323 100644
--- a/net/http/http_auth_gssapi_posix_unittest.cc
+++ b/net/http/http_auth_gssapi_posix_unittest.cc
@@ -202,8 +202,7 @@ TEST(HttpAuthGSSAPITest, ParseChallenge_TwoRounds) {
   // Generate an auth token and create another thing.
   EstablishInitialContext(&mock_library);
   std::string auth_token;
-  EXPECT_EQ(OK, auth_gssapi.GenerateAuthToken(NULL, NULL,
-                                              L"HTTP/intranet.google.com",
+  EXPECT_EQ(OK, auth_gssapi.GenerateAuthToken(NULL, L"HTTP/intranet.google.com",
                                               &auth_token));
 
   std::string second_challenge_text = "Negotiate Zm9vYmFy";
@@ -240,8 +239,7 @@ TEST(HttpAuthGSSAPITest, ParseChallenge_MissingTokenSecondRound) {
 
   EstablishInitialContext(&mock_library);
   std::string auth_token;
-  EXPECT_EQ(OK, auth_gssapi.GenerateAuthToken(NULL, NULL,
-                                              L"HTTP/intranet.google.com",
+  EXPECT_EQ(OK, auth_gssapi.GenerateAuthToken(NULL, L"HTTP/intranet.google.com",
                                               &auth_token));
   std::string second_challenge_text = "Negotiate";
   HttpAuth::ChallengeTokenizer second_challenge(second_challenge_text.begin(),
@@ -264,8 +262,7 @@ TEST(HttpAuthGSSAPITest, ParseChallenge_NonBase64EncodedToken) {
 
   EstablishInitialContext(&mock_library);
   std::string auth_token;
-  EXPECT_EQ(OK, auth_gssapi.GenerateAuthToken(NULL, NULL,
-                                              L"HTTP/intranet.google.com",
+  EXPECT_EQ(OK, auth_gssapi.GenerateAuthToken(NULL, L"HTTP/intranet.google.com",
                                               &auth_token));
   std::string second_challenge_text = "Negotiate =happyjoy=";
   HttpAuth::ChallengeTokenizer second_challenge(second_challenge_text.begin(),
diff --git a/net/http/http_auth_handler.cc b/net/http/http_auth_handler.cc
index 3ba4109..c196b85 100644
--- a/net/http/http_auth_handler.cc
+++ b/net/http/http_auth_handler.cc
@@ -62,20 +62,18 @@ NetLog::EventType EventTypeFromAuthTarget(HttpAuth::Target target) {
 
 }  // namespace
 
-int HttpAuthHandler::GenerateAuthToken(const string16* username,
-                                       const string16* password,
+int HttpAuthHandler::GenerateAuthToken(const AuthCredentials* credentials,
                                        const HttpRequestInfo* request,
                                        OldCompletionCallback* callback,
                                        std::string* auth_token) {
   // TODO(cbentzel): Enforce non-NULL callback after cleaning up SocketStream.
   DCHECK(request);
-  DCHECK((username == NULL) == (password == NULL));
-  DCHECK(username != NULL || AllowsDefaultCredentials());
+  DCHECK(credentials != NULL || AllowsDefaultCredentials());
   DCHECK(auth_token != NULL);
   DCHECK(original_callback_ == NULL);
   original_callback_ = callback;
   net_log_.BeginEvent(EventTypeFromAuthTarget(target_), NULL);
-  int rv = GenerateAuthTokenImpl(username, password, request,
+  int rv = GenerateAuthTokenImpl(credentials, request,
                                  &wrapper_callback_, auth_token);
   if (rv != ERR_IO_PENDING)
     FinishGenerateAuthToken();
diff --git a/net/http/http_auth_handler.h b/net/http/http_auth_handler.h
index a78ae0c..cdda944 100644
--- a/net/http/http_auth_handler.h
+++ b/net/http/http_auth_handler.h
@@ -8,7 +8,6 @@
 
 #include <string>
 
-#include "base/string16.h"
 #include "net/base/completion_callback.h"
 #include "net/base/net_export.h"
 #include "net/base/net_log.h"
@@ -54,24 +53,25 @@ class NET_EXPORT_PRIVATE HttpAuthHandler {
 
   // Generates an authentication token, potentially asynchronously.
   //
-  // When |username| and |password| are NULL, the default credentials for
-  // the currently logged in user are used. |AllowsDefaultCredentials()| MUST be
-  // true in this case.
+  // When |credentials| is NULL, the default credentials for the currently
+  // logged in user are used. |AllowsDefaultCredentials()| MUST be true in this
+  // case.
   //
   // |request|, |callback|, and |auth_token| must be non-NULL.
   //
   // The return value is a net error code.
+  //
   // If |OK| is returned, |*auth_token| is filled in with an authentication
   // token which can be inserted in the HTTP request.
+  //
   // If |ERR_IO_PENDING| is returned, |*auth_token| will be filled in
   // asynchronously and |callback| will be invoked. The lifetime of
   // |request|, |callback|, and |auth_token| must last until |callback| is
-  // invoked, but |username| and |password| are only used during the initial
-  // call.
-  // Otherwise, there was a problem generating a token synchronously, and the
-  // value of |*auth_token| is unspecified.
-  int GenerateAuthToken(const string16* username,
-                        const string16* password,
+  // invoked, but |credentials| is only used during the initial call.
+  //
+  // All other return codes indicate that there was a problem generating a
+  // token, and the value of |*auth_token| is unspecified.
+  int GenerateAuthToken(const AuthCredentials* credentials,
                         const HttpRequestInfo* request,
                         OldCompletionCallback* callback,
                         std::string* auth_token);
@@ -157,8 +157,7 @@ class NET_EXPORT_PRIVATE HttpAuthHandler {
   // |GenerateAuthTokenImpl()} is the auth-scheme specific implementation
   // of generating the next auth token. Callers sohuld use |GenerateAuthToken()|
   // which will in turn call |GenerateAuthTokenImpl()|
-  virtual int GenerateAuthTokenImpl(const string16* username,
-                                    const string16* password,
+  virtual int GenerateAuthTokenImpl(const AuthCredentials* credentials,
                                     const HttpRequestInfo* request,
                                     OldCompletionCallback* callback,
                                     std::string* auth_token) = 0;
diff --git a/net/http/http_auth_handler_basic.cc b/net/http/http_auth_handler_basic.cc
index 5303ac3..df24d0e 100644
--- a/net/http/http_auth_handler_basic.cc
+++ b/net/http/http_auth_handler_basic.cc
@@ -86,15 +86,17 @@ HttpAuth::AuthorizationResult HttpAuthHandlerBasic::HandleAnotherChallenge(
 }
 
 int HttpAuthHandlerBasic::GenerateAuthTokenImpl(
-    const string16* username,
-    const string16* password,
+    const AuthCredentials* credentials,
     const HttpRequestInfo*,
     OldCompletionCallback*,
     std::string* auth_token) {
+  DCHECK(credentials);
   // TODO(eroman): is this the right encoding of username/password?
   std::string base64_username_password;
-  if (!base::Base64Encode(UTF16ToUTF8(*username) + ":" + UTF16ToUTF8(*password),
-                          &base64_username_password)) {
+  if (!base::Base64Encode(
+          UTF16ToUTF8(credentials->username()) + ":" +
+          UTF16ToUTF8(credentials->password()),
+          &base64_username_password)) {
     LOG(ERROR) << "Unexpected problem Base64 encoding.";
     return ERR_UNEXPECTED;
   }
diff --git a/net/http/http_auth_handler_basic.h b/net/http/http_auth_handler_basic.h
index ab1d397..5952d73 100644
--- a/net/http/http_auth_handler_basic.h
+++ b/net/http/http_auth_handler_basic.h
@@ -8,7 +8,6 @@
 
 #include <string>
 
-#include "base/string16.h"
 #include "net/base/net_export.h"
 #include "net/http/http_auth_handler.h"
 #include "net/http/http_auth_handler_factory.h"
@@ -38,8 +37,7 @@ class NET_EXPORT_PRIVATE HttpAuthHandlerBasic : public HttpAuthHandler {
  protected:
   virtual bool Init(HttpAuth::ChallengeTokenizer* challenge);
 
-  virtual int GenerateAuthTokenImpl(const string16* username,
-                                    const string16* password,
+  virtual int GenerateAuthTokenImpl(const AuthCredentials* credentials,
                                     const HttpRequestInfo* request,
                                     OldCompletionCallback* callback,
                                     std::string* auth_token);
diff --git a/net/http/http_auth_handler_basic_unittest.cc b/net/http/http_auth_handler_basic_unittest.cc
index 74d8800..b1e1a84 100644
--- a/net/http/http_auth_handler_basic_unittest.cc
+++ b/net/http/http_auth_handler_basic_unittest.cc
@@ -36,11 +36,11 @@ TEST(HttpAuthHandlerBasicTest, GenerateAuthToken) {
     scoped_ptr<HttpAuthHandler> basic;
     EXPECT_EQ(OK, factory.CreateAuthHandlerFromString(
         challenge, HttpAuth::AUTH_SERVER, origin, BoundNetLog(), &basic));
-    string16 username(ASCIIToUTF16(tests[i].username));
-    string16 password(ASCIIToUTF16(tests[i].password));
+    AuthCredentials credentials(ASCIIToUTF16(tests[i].username),
+                                ASCIIToUTF16(tests[i].password));
     HttpRequestInfo request_info;
     std::string auth_token;
-    int rv = basic->GenerateAuthToken(&username, &password, &request_info,
+    int rv = basic->GenerateAuthToken(&credentials, &request_info,
                                       NULL, &auth_token);
     EXPECT_EQ(OK, rv);
     EXPECT_STREQ(tests[i].expected_credentials, auth_token.c_str());
diff --git a/net/http/http_auth_handler_digest.cc b/net/http/http_auth_handler_digest.cc
index 58c3c32..2b5c026 100644
--- a/net/http/http_auth_handler_digest.cc
+++ b/net/http/http_auth_handler_digest.cc
@@ -137,8 +137,7 @@ bool HttpAuthHandlerDigest::Init(HttpAuth::ChallengeTokenizer* challenge) {
 }
 
 int HttpAuthHandlerDigest::GenerateAuthTokenImpl(
-    const string16* username,
-    const string16* password,
+    const AuthCredentials* credentials,
     const HttpRequestInfo* request,
     OldCompletionCallback* callback,
     std::string* auth_token) {
@@ -151,9 +150,7 @@ int HttpAuthHandlerDigest::GenerateAuthTokenImpl(
   std::string path;
   GetRequestMethodAndPath(request, &method, &path);
 
-  *auth_token = AssembleCredentials(method, path,
-                                    *username,
-                                    *password,
+  *auth_token = AssembleCredentials(method, path, *credentials,
                                     cnonce, nonce_count_);
   return OK;
 }
@@ -320,15 +317,14 @@ void HttpAuthHandlerDigest::GetRequestMethodAndPath(
 std::string HttpAuthHandlerDigest::AssembleResponseDigest(
     const std::string& method,
     const std::string& path,
-    const string16& username,
-    const string16& password,
+    const AuthCredentials& credentials,
     const std::string& cnonce,
     const std::string& nc) const {
   // ha1 = MD5(A1)
   // TODO(eroman): is this the right encoding?
-  std::string ha1 = base::MD5String(UTF16ToUTF8(username) + ":" +
+  std::string ha1 = base::MD5String(UTF16ToUTF8(credentials.username()) + ":" +
                                     original_realm_ + ":" +
-                                    UTF16ToUTF8(password));
+                                    UTF16ToUTF8(credentials.password()));
   if (algorithm_ == HttpAuthHandlerDigest::ALGORITHM_MD5_SESS)
     ha1 = base::MD5String(ha1 + ":" + nonce_ + ":" + cnonce);
 
@@ -347,8 +343,7 @@ std::string HttpAuthHandlerDigest::AssembleResponseDigest(
 std::string HttpAuthHandlerDigest::AssembleCredentials(
     const std::string& method,
     const std::string& path,
-    const string16& username,
-    const string16& password,
+    const AuthCredentials& credentials,
     const std::string& cnonce,
     int nonce_count) const {
   // the nonce-count is an 8 digit hex string.
@@ -356,7 +351,8 @@ std::string HttpAuthHandlerDigest::AssembleCredentials(
 
   // TODO(eroman): is this the right encoding?
   std::string authorization = (std::string("Digest username=") +
-                               HttpUtil::Quote(UTF16ToUTF8(username)));
+                               HttpUtil::Quote(
+                                   UTF16ToUTF8(credentials.username())));
   authorization += ", realm=" + HttpUtil::Quote(original_realm_);
   authorization += ", nonce=" + HttpUtil::Quote(nonce_);
   authorization += ", uri=" + HttpUtil::Quote(path);
@@ -364,8 +360,8 @@ std::string HttpAuthHandlerDigest::AssembleCredentials(
   if (algorithm_ != ALGORITHM_UNSPECIFIED) {
     authorization += ", algorithm=" + AlgorithmToString(algorithm_);
   }
-  std::string response = AssembleResponseDigest(method, path, username,
-                                                password, cnonce, nc);
+  std::string response = AssembleResponseDigest(method, path, credentials,
+                                                cnonce, nc);
   // No need to call HttpUtil::Quote() as the response digest cannot contain
   // any characters needing to be escaped.
   authorization += ", response=\"" + response + "\"";
diff --git a/net/http/http_auth_handler_digest.h b/net/http/http_auth_handler_digest.h
index 1358a4a..5fc0a38 100644
--- a/net/http/http_auth_handler_digest.h
+++ b/net/http/http_auth_handler_digest.h
@@ -11,7 +11,6 @@
 #include "base/basictypes.h"
 #include "base/gtest_prod_util.h"
 #include "base/memory/scoped_ptr.h"
-#include "base/string16.h"
 #include "net/base/net_export.h"
 #include "net/http/http_auth_handler.h"
 #include "net/http/http_auth_handler_factory.h"
@@ -84,8 +83,7 @@ class NET_EXPORT_PRIVATE HttpAuthHandlerDigest : public HttpAuthHandler {
  protected:
   virtual bool Init(HttpAuth::ChallengeTokenizer* challenge);
 
-  virtual int GenerateAuthTokenImpl(const string16* username,
-                                    const string16* password,
+  virtual int GenerateAuthTokenImpl(const AuthCredentials* credentials,
                                     const HttpRequestInfo* request,
                                     OldCompletionCallback* callback,
                                     std::string* auth_token);
@@ -148,16 +146,14 @@ class NET_EXPORT_PRIVATE HttpAuthHandlerDigest : public HttpAuthHandler {
   // Build up  the 'response' production.
   std::string AssembleResponseDigest(const std::string& method,
                                      const std::string& path,
-                                     const string16& username,
-                                     const string16& password,
+                                     const AuthCredentials& credentials,
                                      const std::string& cnonce,
                                      const std::string& nc) const;
 
   // Build up  the value for (Authorization/Proxy-Authorization).
   std::string AssembleCredentials(const std::string& method,
                                   const std::string& path,
-                                  const string16& username,
-                                  const string16& password,
+                                  const AuthCredentials& credentials,
                                   const std::string& cnonce,
                                   int nonce_count) const;
 
diff --git a/net/http/http_auth_handler_digest_unittest.cc b/net/http/http_auth_handler_digest_unittest.cc
index 1f154ca..0bce2a4 100644
--- a/net/http/http_auth_handler_digest_unittest.cc
+++ b/net/http/http_auth_handler_digest_unittest.cc
@@ -67,10 +67,9 @@ bool RespondToChallenge(HttpAuth::Target target,
   TestOldCompletionCallback callback;
   scoped_ptr<HttpRequestInfo> request(new HttpRequestInfo());
   request->url = GURL(request_url);
-  const string16 kFoo = ASCIIToUTF16("foo");
-  const string16 kBar = ASCIIToUTF16("bar");
+  AuthCredentials credentials(ASCIIToUTF16("foo"), ASCIIToUTF16("bar"));
   int rv_generate = handler->GenerateAuthToken(
-      &kFoo, &kBar, request.get(), &callback, token);
+      &credentials, request.get(), &callback, token);
   if (rv_generate != OK) {
     ADD_FAILURE() << "Problems generating auth token";
     return false;
@@ -530,8 +529,9 @@ TEST(HttpAuthHandlerDigestTest, AssembleCredentials) {
     std::string creds =
         digest->AssembleCredentials(tests[i].req_method,
                                     tests[i].req_path,
-                                    ASCIIToUTF16(tests[i].username),
-                                    ASCIIToUTF16(tests[i].password),
+                                    AuthCredentials(
+                                        ASCIIToUTF16(tests[i].username),
+                                        ASCIIToUTF16(tests[i].password)),
                                     tests[i].cnonce,
                                     tests[i].nonce_count);
 
diff --git a/net/http/http_auth_handler_mock.cc b/net/http/http_auth_handler_mock.cc
index 2e5e1e6..d90d823 100644
--- a/net/http/http_auth_handler_mock.cc
+++ b/net/http/http_auth_handler_mock.cc
@@ -105,11 +105,11 @@ bool HttpAuthHandlerMock::Init(HttpAuth::ChallengeTokenizer* challenge) {
   return true;
 }
 
-int HttpAuthHandlerMock::GenerateAuthTokenImpl(const string16* username,
-                                               const string16* password,
-                                               const HttpRequestInfo* request,
-                                               OldCompletionCallback* callback,
-                                               std::string* auth_token) {
+int HttpAuthHandlerMock::GenerateAuthTokenImpl(
+    const AuthCredentials* credentials,
+    const HttpRequestInfo* request,
+    OldCompletionCallback* callback,
+    std::string* auth_token) {
   first_round_ = false;
   request_url_ = request->url;
   if (generate_async_) {
diff --git a/net/http/http_auth_handler_mock.h b/net/http/http_auth_handler_mock.h
index a78b876..5c87c21 100644
--- a/net/http/http_auth_handler_mock.h
+++ b/net/http/http_auth_handler_mock.h
@@ -10,7 +10,6 @@
 
 #include "base/memory/scoped_vector.h"
 #include "base/memory/weak_ptr.h"
-#include "base/string16.h"
 #include "googleurl/src/gurl.h"
 #include "net/http/http_auth_handler.h"
 #include "net/http/http_auth_handler_factory.h"
@@ -97,8 +96,7 @@ class HttpAuthHandlerMock : public HttpAuthHandler {
  protected:
   virtual bool Init(HttpAuth::ChallengeTokenizer* challenge);
 
-  virtual int GenerateAuthTokenImpl(const string16* username,
-                                    const string16* password,
+  virtual int GenerateAuthTokenImpl(const AuthCredentials* credentials,
                                     const HttpRequestInfo* request,
                                     OldCompletionCallback* callback,
                                     std::string* auth_token);
diff --git a/net/http/http_auth_handler_negotiate.cc b/net/http/http_auth_handler_negotiate.cc
index b499c5b..05604bd 100644
--- a/net/http/http_auth_handler_negotiate.cc
+++ b/net/http/http_auth_handler_negotiate.cc
@@ -105,7 +105,7 @@ HttpAuthHandlerNegotiate::HttpAuthHandlerNegotiate(
           this, &HttpAuthHandlerNegotiate::OnIOComplete)),
       resolver_(resolver),
       already_called_(false),
-      has_username_and_password_(false),
+      has_credentials_(false),
       user_callback_(NULL),
       auth_token_(NULL),
       next_state_(STATE_NONE),
@@ -212,26 +212,22 @@ bool HttpAuthHandlerNegotiate::Init(HttpAuth::ChallengeTokenizer* challenge) {
 }
 
 int HttpAuthHandlerNegotiate::GenerateAuthTokenImpl(
-    const string16* username,
-    const string16* password,
+    const AuthCredentials* credentials,
     const HttpRequestInfo* request,
     OldCompletionCallback* callback,
     std::string* auth_token) {
   DCHECK(user_callback_ == NULL);
-  DCHECK((username == NULL) == (password == NULL));
   DCHECK(auth_token_ == NULL);
   auth_token_ = auth_token;
   if (already_called_) {
-    DCHECK((!has_username_and_password_ && username == NULL) ||
-           (has_username_and_password_ && *username == username_ &&
-            *password == password_));
+    DCHECK((!has_credentials_ && credentials == NULL) ||
+           (has_credentials_ && credentials->Equals(credentials_)));
     next_state_ = STATE_GENERATE_AUTH_TOKEN;
   } else {
     already_called_ = true;
-    if (username) {
-      has_username_and_password_ = true;
-      username_ = *username;
-      password_ = *password;
+    if (credentials) {
+      has_credentials_ = true;
+      credentials_ = *credentials;
     }
     next_state_ = STATE_RESOLVE_CANONICAL_NAME;
   }
@@ -319,10 +315,9 @@ int HttpAuthHandlerNegotiate::DoResolveCanonicalNameComplete(int rv) {
 
 int HttpAuthHandlerNegotiate::DoGenerateAuthToken() {
   next_state_ = STATE_GENERATE_AUTH_TOKEN_COMPLETE;
-  string16* username = has_username_and_password_ ? &username_ : NULL;
-  string16* password = has_username_and_password_ ? &password_ : NULL;
+  AuthCredentials* credentials = has_credentials_ ? &credentials_ : NULL;
   // TODO(cbentzel): This should possibly be done async.
-  return auth_system_.GenerateAuthToken(username, password, spn_, auth_token_);
+  return auth_system_.GenerateAuthToken(credentials, spn_, auth_token_);
 }
 
 int HttpAuthHandlerNegotiate::DoGenerateAuthTokenComplete(int rv) {
diff --git a/net/http/http_auth_handler_negotiate.h b/net/http/http_auth_handler_negotiate.h
index 4b04f7b..8619bf4 100644
--- a/net/http/http_auth_handler_negotiate.h
+++ b/net/http/http_auth_handler_negotiate.h
@@ -8,7 +8,6 @@
 
 #include <string>
 
-#include "base/string16.h"
 #include "build/build_config.h"
 #include "net/base/address_list.h"
 #include "net/base/net_export.h"
@@ -116,8 +115,7 @@ class NET_EXPORT_PRIVATE HttpAuthHandlerNegotiate : public HttpAuthHandler {
  protected:
   virtual bool Init(HttpAuth::ChallengeTokenizer* challenge);
 
-  virtual int GenerateAuthTokenImpl(const string16* username,
-                                    const string16* password,
+  virtual int GenerateAuthTokenImpl(const AuthCredentials* credentials,
                                     const HttpRequestInfo* request,
                                     OldCompletionCallback* callback,
                                     std::string* auth_token);
@@ -153,9 +151,8 @@ class NET_EXPORT_PRIVATE HttpAuthHandlerNegotiate : public HttpAuthHandler {
 
   // Things which should be consistent after first call to GenerateAuthToken.
   bool already_called_;
-  bool has_username_and_password_;
-  string16 username_;
-  string16 password_;
+  bool has_credentials_;
+  AuthCredentials credentials_;
   std::wstring spn_;
 
   // Things which vary each round.
diff --git a/net/http/http_auth_handler_negotiate_unittest.cc b/net/http/http_auth_handler_negotiate_unittest.cc
index e43d994..4c013d2 100644
--- a/net/http/http_auth_handler_negotiate_unittest.cc
+++ b/net/http/http_auth_handler_negotiate_unittest.cc
@@ -223,8 +223,7 @@ TEST_F(HttpAuthHandlerNegotiateTest, DisableCname) {
   TestOldCompletionCallback callback;
   HttpRequestInfo request_info;
   std::string token;
-  EXPECT_EQ(OK, auth_handler->GenerateAuthToken(NULL, NULL,
-                                                &request_info,
+  EXPECT_EQ(OK, auth_handler->GenerateAuthToken(NULL, &request_info,
                                                 &callback, &token));
 #if defined(OS_WIN)
   EXPECT_EQ(L"HTTP/alias", auth_handler->spn());
@@ -242,8 +241,7 @@ TEST_F(HttpAuthHandlerNegotiateTest, DisableCnameStandardPort) {
   TestOldCompletionCallback callback;
   HttpRequestInfo request_info;
   std::string token;
-  EXPECT_EQ(OK, auth_handler->GenerateAuthToken(NULL, NULL,
-                                                &request_info,
+  EXPECT_EQ(OK, auth_handler->GenerateAuthToken(NULL, &request_info,
                                                 &callback, &token));
 #if defined(OS_WIN)
   EXPECT_EQ(L"HTTP/alias", auth_handler->spn());
@@ -261,8 +259,7 @@ TEST_F(HttpAuthHandlerNegotiateTest, DisableCnameNonstandardPort) {
   TestOldCompletionCallback callback;
   HttpRequestInfo request_info;
   std::string token;
-  EXPECT_EQ(OK, auth_handler->GenerateAuthToken(NULL, NULL,
-                                                &request_info,
+  EXPECT_EQ(OK, auth_handler->GenerateAuthToken(NULL, &request_info,
                                                 &callback, &token));
 #if defined(OS_WIN)
   EXPECT_EQ(L"HTTP/alias:500", auth_handler->spn());
@@ -280,8 +277,7 @@ TEST_F(HttpAuthHandlerNegotiateTest, CnameSync) {
   TestOldCompletionCallback callback;
   HttpRequestInfo request_info;
   std::string token;
-  EXPECT_EQ(OK, auth_handler->GenerateAuthToken(NULL, NULL,
-                                                &request_info,
+  EXPECT_EQ(OK, auth_handler->GenerateAuthToken(NULL, &request_info,
                                                 &callback, &token));
 #if defined(OS_WIN)
   EXPECT_EQ(L"HTTP/canonical.example.com", auth_handler->spn());
@@ -300,7 +296,7 @@ TEST_F(HttpAuthHandlerNegotiateTest, CnameAsync) {
   HttpRequestInfo request_info;
   std::string token;
   EXPECT_EQ(ERR_IO_PENDING, auth_handler->GenerateAuthToken(
-      NULL, NULL, &request_info, &callback, &token));
+      NULL, &request_info, &callback, &token));
   EXPECT_EQ(OK, callback.WaitForResult());
 #if defined(OS_WIN)
   EXPECT_EQ(L"HTTP/canonical.example.com", auth_handler->spn());
@@ -323,7 +319,7 @@ TEST_F(HttpAuthHandlerNegotiateTest, ServerNotInKerberosDatabase) {
   HttpRequestInfo request_info;
   std::string token;
   EXPECT_EQ(ERR_IO_PENDING, auth_handler->GenerateAuthToken(
-      NULL, NULL, &request_info, &callback, &token));
+      NULL, &request_info, &callback, &token));
   EXPECT_EQ(ERR_MISSING_AUTH_CREDENTIALS, callback.WaitForResult());
 }
 
@@ -339,7 +335,7 @@ TEST_F(HttpAuthHandlerNegotiateTest, NoKerberosCredentials) {
   HttpRequestInfo request_info;
   std::string token;
   EXPECT_EQ(ERR_IO_PENDING, auth_handler->GenerateAuthToken(
-      NULL, NULL, &request_info, &callback, &token));
+      NULL, &request_info, &callback, &token));
   EXPECT_EQ(ERR_MISSING_AUTH_CREDENTIALS, callback.WaitForResult());
 }
 
diff --git a/net/http/http_auth_handler_ntlm.cc b/net/http/http_auth_handler_ntlm.cc
index 91fff61..3bbc045 100644
--- a/net/http/http_auth_handler_ntlm.cc
+++ b/net/http/http_auth_handler_ntlm.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -29,20 +29,18 @@ bool HttpAuthHandlerNTLM::Init(HttpAuth::ChallengeTokenizer* tok) {
 }
 
 int HttpAuthHandlerNTLM::GenerateAuthTokenImpl(
-    const string16* username,
-    const string16* password,
+    const AuthCredentials* credentials,
     const HttpRequestInfo* request,
     OldCompletionCallback* callback,
     std::string* auth_token) {
 #if defined(NTLM_SSPI)
   return auth_sspi_.GenerateAuthToken(
-      username,
-      password,
+      credentials,
       CreateSPN(origin_),
       auth_token);
 #else  // !defined(NTLM_SSPI)
   // TODO(cbentzel): Shouldn't be hitting this case.
-  if (!username || !password) {
+  if (!credentials) {
     LOG(ERROR) << "Username and password are expected to be non-NULL.";
     return ERR_MISSING_AUTH_CREDENTIALS;
   }
@@ -54,21 +52,21 @@ int HttpAuthHandlerNTLM::GenerateAuthTokenImpl(
   uint32 in_buf_len, out_buf_len;
   std::string decoded_auth_data;
 
-  // |username| may be in the form "DOMAIN\user".  Parse it into the two
+  // The username may be in the form "DOMAIN\user".  Parse it into the two
   // components.
   string16 domain;
   string16 user;
+  const string16& username = credentials->username();
   const char16 backslash_character = '\\';
-  size_t backslash_idx = username->find(backslash_character);
+  size_t backslash_idx = username.find(backslash_character);
   if (backslash_idx == string16::npos) {
-    user = *username;
+    user = username;
   } else {
-    domain = username->substr(0, backslash_idx);
-    user = username->substr(backslash_idx + 1);
+    domain = username.substr(0, backslash_idx);
+    user = username.substr(backslash_idx + 1);
   }
   domain_ = domain;
-  username_ = user;
-  password_ = *password;
+  credentials_.Set(user, credentials->password());
 
   // Initial challenge.
   if (auth_data_.empty()) {
diff --git a/net/http/http_auth_handler_ntlm.h b/net/http/http_auth_handler_ntlm.h
index d3820f8..27dcd48 100644
--- a/net/http/http_auth_handler_ntlm.h
+++ b/net/http/http_auth_handler_ntlm.h
@@ -118,8 +118,7 @@ class NET_EXPORT_PRIVATE HttpAuthHandlerNTLM : public HttpAuthHandler {
 
   virtual bool Init(HttpAuth::ChallengeTokenizer* tok);
 
-  virtual int GenerateAuthTokenImpl(const string16* username,
-                                    const string16* password,
+  virtual int GenerateAuthTokenImpl(const AuthCredentials* credentials,
                                     const HttpRequestInfo* request,
                                     OldCompletionCallback* callback,
                                     std::string* auth_token);
@@ -158,8 +157,7 @@ class NET_EXPORT_PRIVATE HttpAuthHandlerNTLM : public HttpAuthHandler {
 #endif
 
   string16 domain_;
-  string16 username_;
-  string16 password_;
+  AuthCredentials credentials_;
 
   // The base64-encoded string following "NTLM" in the "WWW-Authenticate" or
   // "Proxy-Authenticate" response header.
diff --git a/net/http/http_auth_handler_ntlm_portable.cc b/net/http/http_auth_handler_ntlm_portable.cc
index 92b3e5b..d5febb6 100644
--- a/net/http/http_auth_handler_ntlm_portable.cc
+++ b/net/http/http_auth_handler_ntlm_portable.cc
@@ -19,6 +19,7 @@
 #include "base/utf_string_conversions.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_util.h"
+#include "net/base/zap.h"
 #include "net/http/des.h"
 #include "net/http/md4.h"
 
@@ -238,20 +239,6 @@ static uint32 ReadUint32(const uint8*& buf) {
 
 //-----------------------------------------------------------------------------
 
-static void ZapBuf(void* buf, size_t buf_len) {
-  memset(buf, 0, buf_len);
-}
-
-// TODO(wtc): Can we implement ZapString as
-// s.replace(0, s.size(), s.size(), '\0)?
-static void ZapString(std::string* s) {
-  ZapBuf(&(*s)[0], s->length());
-}
-
-static void ZapString(string16* s) {
-  ZapBuf(&(*s)[0], s->length() * 2);
-}
-
 // LM_Hash computes the LM hash of the given password.
 //
 // param password
@@ -661,9 +648,7 @@ int HttpAuthHandlerNTLM::InitializeBeforeFirstChallenge() {
 }
 
 HttpAuthHandlerNTLM::~HttpAuthHandlerNTLM() {
-  // Wipe our copy of the password from memory, to reduce the chance of being
-  // written to the paging file on disk.
-  ZapString(&password_);
+  credentials_.Zap();
 }
 
 // static
@@ -703,7 +688,9 @@ int HttpAuthHandlerNTLM::GetNextToken(const void* in_token,
       return ERR_UNEXPECTED;
     uint8 rand_buf[8];
     generate_random_proc_(rand_buf, 8);
-    rv = GenerateType3Msg(domain_, username_, password_, hostname, rand_buf,
+    rv = GenerateType3Msg(domain_,
+                          credentials_.username(), credentials_.password(),
+                          hostname, rand_buf,
                           in_token, in_token_len, out_token, out_token_len);
   } else {
     rv = GenerateType1Msg(out_token, out_token_len);
diff --git a/net/http/http_auth_handler_unittest.cc b/net/http/http_auth_handler_unittest.cc
index 9b3de57..011c689 100644
--- a/net/http/http_auth_handler_unittest.cc
+++ b/net/http/http_auth_handler_unittest.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -20,8 +20,7 @@ TEST(HttpAuthHandlerTest, NetLog) {
   NetLog::Source source;
   GURL origin("http://www.example.com");
   std::string challenge = "Mock asdf";
-  string16 username = ASCIIToUTF16("user");
-  string16 password = ASCIIToUTF16("pass");
+  AuthCredentials credentials(ASCIIToUTF16("user"), ASCIIToUTF16("pass"));
   std::string auth_token;
   HttpRequestInfo request;
 
@@ -44,7 +43,7 @@ TEST(HttpAuthHandlerTest, NetLog) {
         mock_handler.InitFromChallenge(&tokenizer, target,
                                        origin, bound_net_log);
         mock_handler.SetGenerateExpectation(async, rv);
-        mock_handler.GenerateAuthToken(&username, &password, &request,
+        mock_handler.GenerateAuthToken(&credentials, &request,
                                        &test_callback, &auth_token);
         if (async)
           test_callback.WaitForResult();
diff --git a/net/http/http_auth_sspi_win.cc b/net/http/http_auth_sspi_win.cc
index d07ce4c..f4cbe9d 100644
--- a/net/http/http_auth_sspi_win.cc
+++ b/net/http/http_auth_sspi_win.cc
@@ -254,15 +254,12 @@ HttpAuth::AuthorizationResult HttpAuthSSPI::ParseChallenge(
   return HttpAuth::AUTHORIZATION_RESULT_ACCEPT;
 }
 
-int HttpAuthSSPI::GenerateAuthToken(const string16* username,
-                                    const string16* password,
+int HttpAuthSSPI::GenerateAuthToken(const AuthCredentials* credentials,
                                     const std::wstring& spn,
                                     std::string* auth_token) {
-  DCHECK((username == NULL) == (password == NULL));
-
   // Initial challenge.
   if (!SecIsValidHandle(&cred_)) {
-    int rv = OnFirstRound(username, password);
+    int rv = OnFirstRound(credentials);
     if (rv != OK)
       return rv;
   }
@@ -294,17 +291,15 @@ int HttpAuthSSPI::GenerateAuthToken(const string16* username,
   return OK;
 }
 
-int HttpAuthSSPI::OnFirstRound(const string16* username,
-                               const string16* password) {
-  DCHECK((username == NULL) == (password == NULL));
+int HttpAuthSSPI::OnFirstRound(const AuthCredentials* credentials) {
   DCHECK(!SecIsValidHandle(&cred_));
   int rv = OK;
-  if (username) {
+  if (credentials) {
     string16 domain;
     string16 user;
-    SplitDomainAndUser(*username, &domain, &user);
+    SplitDomainAndUser(credentials->username(), &domain, &user);
     rv = AcquireExplicitCredentials(library_, security_package_, domain,
-                                    user, *password, &cred_);
+                                    user, credentials->password(), &cred_);
     if (rv != OK)
       return rv;
   } else {
diff --git a/net/http/http_auth_sspi_win.h b/net/http/http_auth_sspi_win.h
index b3ef3c9..e33dcc5 100644
--- a/net/http/http_auth_sspi_win.h
+++ b/net/http/http_auth_sspi_win.h
@@ -142,11 +142,9 @@ class NET_EXPORT_PRIVATE HttpAuthSSPI {
   // If the return value is not |OK|, then the value of |*auth_token| is
   // unspecified. ERR_IO_PENDING is not a valid return code.
   // If this is the first round of a multiple round scheme, credentials are
-  // obtained using |*username| and |*password|. If |username| and |password|
-  // are both NULL, the credentials for the currently logged in user are used
-  // instead.
-  int GenerateAuthToken(const string16* username,
-                        const string16* password,
+  // obtained using |*credentials|. If |credentials| is NULL, the credentials
+  // for the currently logged in user are used instead.
+  int GenerateAuthToken(const AuthCredentials* credentials,
                         const std::wstring& spn,
                         std::string* auth_token);
 
@@ -156,7 +154,7 @@ class NET_EXPORT_PRIVATE HttpAuthSSPI {
   void Delegate();
 
  private:
-  int OnFirstRound(const string16* username, const string16* password);
+  int OnFirstRound(const AuthCredentials* credentials);
 
   int GetNextSecurityToken(
       const std::wstring& spn,
diff --git a/net/http/http_auth_sspi_win_unittest.cc b/net/http/http_auth_sspi_win_unittest.cc
index 331dcd6..d852137 100644
--- a/net/http/http_auth_sspi_win_unittest.cc
+++ b/net/http/http_auth_sspi_win_unittest.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -82,8 +82,7 @@ TEST(HttpAuthSSPITest, ParseChallenge_TwoRounds) {
 
   // Generate an auth token and create another thing.
   std::string auth_token;
-  EXPECT_EQ(OK, auth_sspi.GenerateAuthToken(NULL, NULL,
-                                            L"HTTP/intranet.google.com",
+  EXPECT_EQ(OK, auth_sspi.GenerateAuthToken(NULL, L"HTTP/intranet.google.com",
                                             &auth_token));
 
   std::string second_challenge_text = "Negotiate Zm9vYmFy";
@@ -119,8 +118,7 @@ TEST(HttpAuthSSPITest, ParseChallenge_MissingTokenSecondRound) {
             auth_sspi.ParseChallenge(&first_challenge));
 
   std::string auth_token;
-  EXPECT_EQ(OK, auth_sspi.GenerateAuthToken(NULL, NULL,
-                                            L"HTTP/intranet.google.com",
+  EXPECT_EQ(OK, auth_sspi.GenerateAuthToken(NULL, L"HTTP/intranet.google.com",
                                             &auth_token));
   std::string second_challenge_text = "Negotiate";
   HttpAuth::ChallengeTokenizer second_challenge(second_challenge_text.begin(),
@@ -142,8 +140,7 @@ TEST(HttpAuthSSPITest, ParseChallenge_NonBase64EncodedToken) {
             auth_sspi.ParseChallenge(&first_challenge));
 
   std::string auth_token;
-  EXPECT_EQ(OK, auth_sspi.GenerateAuthToken(NULL, NULL,
-                                            L"HTTP/intranet.google.com",
+  EXPECT_EQ(OK, auth_sspi.GenerateAuthToken(NULL, L"HTTP/intranet.google.com",
                                             &auth_token));
   std::string second_challenge_text = "Negotiate =happyjoy=";
   HttpAuth::ChallengeTokenizer second_challenge(second_challenge_text.begin(),
diff --git a/net/http/http_cache_transaction.cc b/net/http/http_cache_transaction.cc
index 675564f..a10cf98 100644
--- a/net/http/http_cache_transaction.cc
+++ b/net/http/http_cache_transaction.cc
@@ -282,8 +282,7 @@ int HttpCache::Transaction::RestartWithCertificate(
 }
 
 int HttpCache::Transaction::RestartWithAuth(
-    const string16& username,
-    const string16& password,
+    const AuthCredentials& credentials,
     OldCompletionCallback* callback) {
   DCHECK(auth_response_.headers);
   DCHECK(callback);
@@ -297,7 +296,7 @@ int HttpCache::Transaction::RestartWithAuth(
   // Clear the intermediate response since we are going to start over.
   auth_response_ = HttpResponseInfo();
 
-  int rv = RestartNetworkRequestWithAuth(username, password);
+  int rv = RestartNetworkRequestWithAuth(credentials);
 
   if (rv == ERR_IO_PENDING)
     callback_ = callback;
@@ -1680,14 +1679,13 @@ int HttpCache::Transaction::RestartNetworkRequestWithCertificate(
 }
 
 int HttpCache::Transaction::RestartNetworkRequestWithAuth(
-    const string16& username,
-    const string16& password) {
+    const AuthCredentials& credentials) {
   DCHECK(mode_ & WRITE || mode_ == NONE);
   DCHECK(network_trans_.get());
   DCHECK_EQ(STATE_NONE, next_state_);
 
   next_state_ = STATE_SEND_REQUEST_COMPLETE;
-  int rv = network_trans_->RestartWithAuth(username, password, &io_callback_);
+  int rv = network_trans_->RestartWithAuth(credentials, &io_callback_);
   if (rv != ERR_IO_PENDING)
     return DoLoop(rv);
   return rv;
diff --git a/net/http/http_cache_transaction.h b/net/http/http_cache_transaction.h
index 665f92f..cc96e80 100644
--- a/net/http/http_cache_transaction.h
+++ b/net/http/http_cache_transaction.h
@@ -11,7 +11,6 @@
 
 #include <string>
 
-#include "base/string16.h"
 #include "base/time.h"
 #include "net/base/net_log.h"
 #include "net/http/http_cache.h"
@@ -103,8 +102,7 @@ class HttpCache::Transaction : public HttpTransaction {
   virtual int RestartIgnoringLastError(OldCompletionCallback* callback);
   virtual int RestartWithCertificate(X509Certificate* client_cert,
                                      OldCompletionCallback* callback);
-  virtual int RestartWithAuth(const string16& username,
-                              const string16& password,
+  virtual int RestartWithAuth(const AuthCredentials& credentials,
                               OldCompletionCallback* callback);
   virtual bool IsReadyToRestartForAuth();
   virtual int Read(IOBuffer* buf, int buf_len, OldCompletionCallback* callback);
@@ -258,8 +256,7 @@ class HttpCache::Transaction : public HttpTransaction {
 
   // Called to restart a network transaction with authentication credentials.
   // Returns network error code.
-  int RestartNetworkRequestWithAuth(const string16& username,
-                                    const string16& password);
+  int RestartNetworkRequestWithAuth(const AuthCredentials& credentials);
 
   // Called to determine if we need to validate the cache entry before using it.
   bool RequiresValidation();
diff --git a/net/http/http_network_transaction.cc b/net/http/http_network_transaction.cc
index c66f0f3..7c2b2bb 100644
--- a/net/http/http_network_transaction.cc
+++ b/net/http/http_network_transaction.cc
@@ -203,10 +203,8 @@ int HttpNetworkTransaction::RestartWithCertificate(
   return rv;
 }
 
-int HttpNetworkTransaction::RestartWithAuth(
-    const string16& username,
-    const string16& password,
-    OldCompletionCallback* callback) {
+int HttpNetworkTransaction::RestartWithAuth(const AuthCredentials& credentials,
+                                            OldCompletionCallback* callback) {
   HttpAuth::Target target = pending_auth_target_;
   if (target == HttpAuth::AUTH_NONE) {
     NOTREACHED();
@@ -214,7 +212,7 @@ int HttpNetworkTransaction::RestartWithAuth(
   }
   pending_auth_target_ = HttpAuth::AUTH_NONE;
 
-  auth_controllers_[target]->ResetAuth(username, password);
+  auth_controllers_[target]->ResetAuth(credentials);
 
   DCHECK(user_callback_ == NULL);
 
@@ -226,7 +224,7 @@ int HttpNetworkTransaction::RestartWithAuth(
     DCHECK(stream_request_ != NULL);
     auth_controllers_[target] = NULL;
     ResetStateForRestart();
-    rv = stream_request_->RestartTunnelWithProxyAuth(username, password);
+    rv = stream_request_->RestartTunnelWithProxyAuth(credentials);
   } else {
     // In this case, we've gathered credentials for the server or the proxy
     // but it is not during the tunneling phase.
diff --git a/net/http/http_network_transaction.h b/net/http/http_network_transaction.h
index 770c6ba..a7c5bc0 100644
--- a/net/http/http_network_transaction.h
+++ b/net/http/http_network_transaction.h
@@ -47,9 +47,8 @@ class NET_EXPORT_PRIVATE HttpNetworkTransaction
   virtual int RestartIgnoringLastError(OldCompletionCallback* callback);
   virtual int RestartWithCertificate(X509Certificate* client_cert,
                                      OldCompletionCallback* callback);
-  virtual int RestartWithAuth(const string16& username,
-                              const string16& password,
-                              OldCompletionCallback* callback);
+  virtual int RestartWithAuth(const AuthCredentials& credentials,
+                              OldCompletionCallback* callback) OVERRIDE;
   virtual bool IsReadyToRestartForAuth();
 
   virtual int Read(IOBuffer* buf, int buf_len, OldCompletionCallback* callback);
diff --git a/net/http/http_network_transaction_unittest.cc b/net/http/http_network_transaction_unittest.cc
index 546935e..7d4329e 100644
--- a/net/http/http_network_transaction_unittest.cc
+++ b/net/http/http_network_transaction_unittest.cc
@@ -1286,7 +1286,7 @@ TEST_F(HttpNetworkTransactionTest, BasicAuth) {
 
   TestOldCompletionCallback callback2;
 
-  rv = trans->RestartWithAuth(kFoo, kBar, &callback2);
+  rv = trans->RestartWithAuth(AuthCredentials(kFoo, kBar), &callback2);
   EXPECT_EQ(ERR_IO_PENDING, rv);
 
   rv = callback2.WaitForResult();
@@ -1405,7 +1405,7 @@ TEST_F(HttpNetworkTransactionTest, BasicAuthKeepAlive) {
 
   TestOldCompletionCallback callback2;
 
-  rv = trans->RestartWithAuth(kFoo, kBar, &callback2);
+  rv = trans->RestartWithAuth(AuthCredentials(kFoo, kBar), &callback2);
   EXPECT_EQ(ERR_IO_PENDING, rv);
 
   rv = callback2.WaitForResult();
@@ -1480,7 +1480,7 @@ TEST_F(HttpNetworkTransactionTest, BasicAuthKeepAliveNoBody) {
 
   TestOldCompletionCallback callback2;
 
-  rv = trans->RestartWithAuth(kFoo, kBar, &callback2);
+  rv = trans->RestartWithAuth(AuthCredentials(kFoo, kBar), &callback2);
   EXPECT_EQ(ERR_IO_PENDING, rv);
 
   rv = callback2.WaitForResult();
@@ -1563,7 +1563,7 @@ TEST_F(HttpNetworkTransactionTest, BasicAuthKeepAliveLargeBody) {
 
   TestOldCompletionCallback callback2;
 
-  rv = trans->RestartWithAuth(kFoo, kBar, &callback2);
+  rv = trans->RestartWithAuth(AuthCredentials(kFoo, kBar), &callback2);
   EXPECT_EQ(ERR_IO_PENDING, rv);
 
   rv = callback2.WaitForResult();
@@ -1648,7 +1648,7 @@ TEST_F(HttpNetworkTransactionTest, BasicAuthKeepAliveImpatientServer) {
 
   TestOldCompletionCallback callback2;
 
-  rv = trans->RestartWithAuth(kFoo, kBar, &callback2);
+  rv = trans->RestartWithAuth(AuthCredentials(kFoo, kBar), &callback2);
   EXPECT_EQ(ERR_IO_PENDING, rv);
 
   rv = callback2.WaitForResult();
@@ -1743,7 +1743,7 @@ TEST_F(HttpNetworkTransactionTest, BasicAuthProxyNoKeepAlive) {
 
   TestOldCompletionCallback callback2;
 
-  rv = trans->RestartWithAuth(kFoo, kBar, &callback2);
+  rv = trans->RestartWithAuth(AuthCredentials(kFoo, kBar), &callback2);
   EXPECT_EQ(ERR_IO_PENDING, rv);
 
   rv = callback2.WaitForResult();
@@ -1846,7 +1846,7 @@ TEST_F(HttpNetworkTransactionTest, BasicAuthProxyKeepAlive) {
   TestOldCompletionCallback callback2;
 
   // Wrong password (should be "bar").
-  rv = trans->RestartWithAuth(kFoo, kBaz, &callback2);
+  rv = trans->RestartWithAuth(AuthCredentials(kFoo, kBaz), &callback2);
   EXPECT_EQ(ERR_IO_PENDING, rv);
 
   rv = callback2.WaitForResult();
@@ -2228,7 +2228,7 @@ TEST_F(HttpNetworkTransactionTest, HttpsProxySpdyGetWithProxyAuth) {
 
   TestOldCompletionCallback callback2;
 
-  rv = trans->RestartWithAuth(kFoo, kBar, &callback2);
+  rv = trans->RestartWithAuth(AuthCredentials(kFoo, kBar), &callback2);
   EXPECT_EQ(ERR_IO_PENDING, rv);
 
   rv = callback2.WaitForResult();
@@ -2528,7 +2528,7 @@ TEST_F(HttpNetworkTransactionTest, HttpsProxyAuthRetry) {
 
   TestOldCompletionCallback callback2;
 
-  rv = trans->RestartWithAuth(kFoo, kBar, &callback2);
+  rv = trans->RestartWithAuth(AuthCredentials(kFoo, kBar), &callback2);
   EXPECT_EQ(ERR_IO_PENDING, rv);
 
   rv = callback2.WaitForResult();
@@ -2854,7 +2854,7 @@ TEST_F(HttpNetworkTransactionTest, BasicAuthProxyThenServer) {
 
   TestOldCompletionCallback callback2;
 
-  rv = trans->RestartWithAuth(kFoo, kBar, &callback2);
+  rv = trans->RestartWithAuth(AuthCredentials(kFoo, kBar), &callback2);
   EXPECT_EQ(ERR_IO_PENDING, rv);
 
   rv = callback2.WaitForResult();
@@ -2866,7 +2866,7 @@ TEST_F(HttpNetworkTransactionTest, BasicAuthProxyThenServer) {
 
   TestOldCompletionCallback callback3;
 
-  rv = trans->RestartWithAuth(kFoo2, kBar2, &callback3);
+  rv = trans->RestartWithAuth(AuthCredentials(kFoo2, kBar2), &callback3);
   EXPECT_EQ(ERR_IO_PENDING, rv);
 
   rv = callback3.WaitForResult();
@@ -2987,7 +2987,8 @@ TEST_F(HttpNetworkTransactionTest, NTLMAuth1) {
 
   TestOldCompletionCallback callback2;
 
-  rv = trans->RestartWithAuth(kTestingNTLM, kTestingNTLM, &callback2);
+  rv = trans->RestartWithAuth(AuthCredentials(kTestingNTLM, kTestingNTLM),
+                              &callback2);
   EXPECT_EQ(ERR_IO_PENDING, rv);
 
   rv = callback2.WaitForResult();
@@ -3001,7 +3002,7 @@ TEST_F(HttpNetworkTransactionTest, NTLMAuth1) {
 
   TestOldCompletionCallback callback3;
 
-  rv = trans->RestartWithAuth(string16(), string16(), &callback3);
+  rv = trans->RestartWithAuth(AuthCredentials(), &callback3);
   EXPECT_EQ(ERR_IO_PENDING, rv);
 
   rv = callback3.WaitForResult();
@@ -3167,7 +3168,8 @@ TEST_F(HttpNetworkTransactionTest, NTLMAuth2) {
   TestOldCompletionCallback callback2;
 
   // Enter the wrong password.
-  rv = trans->RestartWithAuth(kTestingNTLM, kWrongPassword, &callback2);
+  rv = trans->RestartWithAuth(AuthCredentials(kTestingNTLM, kWrongPassword),
+                              &callback2);
   EXPECT_EQ(ERR_IO_PENDING, rv);
 
   rv = callback2.WaitForResult();
@@ -3175,7 +3177,7 @@ TEST_F(HttpNetworkTransactionTest, NTLMAuth2) {
 
   EXPECT_TRUE(trans->IsReadyToRestartForAuth());
   TestOldCompletionCallback callback3;
-  rv = trans->RestartWithAuth(string16(), string16(), &callback3);
+  rv = trans->RestartWithAuth(AuthCredentials(), &callback3);
   EXPECT_EQ(ERR_IO_PENDING, rv);
   rv = callback3.WaitForResult();
   EXPECT_EQ(OK, rv);
@@ -3188,7 +3190,8 @@ TEST_F(HttpNetworkTransactionTest, NTLMAuth2) {
   TestOldCompletionCallback callback4;
 
   // Now enter the right password.
-  rv = trans->RestartWithAuth(kTestingNTLM, kTestingNTLM, &callback4);
+  rv = trans->RestartWithAuth(AuthCredentials(kTestingNTLM, kTestingNTLM),
+                              &callback4);
   EXPECT_EQ(ERR_IO_PENDING, rv);
 
   rv = callback4.WaitForResult();
@@ -3199,7 +3202,7 @@ TEST_F(HttpNetworkTransactionTest, NTLMAuth2) {
   TestOldCompletionCallback callback5;
 
   // One more roundtrip
-  rv = trans->RestartWithAuth(string16(), string16(), &callback5);
+  rv = trans->RestartWithAuth(AuthCredentials(), &callback5);
   EXPECT_EQ(ERR_IO_PENDING, rv);
 
   rv = callback5.WaitForResult();
@@ -3726,7 +3729,7 @@ TEST_F(HttpNetworkTransactionTest, AuthIdentityInURL) {
 
   EXPECT_TRUE(trans->IsReadyToRestartForAuth());
   TestOldCompletionCallback callback2;
-  rv = trans->RestartWithAuth(string16(), string16(), &callback2);
+  rv = trans->RestartWithAuth(AuthCredentials(), &callback2);
   EXPECT_EQ(ERR_IO_PENDING, rv);
   rv = callback2.WaitForResult();
   EXPECT_EQ(OK, rv);
@@ -3824,7 +3827,7 @@ TEST_F(HttpNetworkTransactionTest, WrongAuthIdentityInURL) {
 
   EXPECT_TRUE(trans->IsReadyToRestartForAuth());
   TestOldCompletionCallback callback2;
-  rv = trans->RestartWithAuth(string16(), string16(), &callback2);
+  rv = trans->RestartWithAuth(AuthCredentials(), &callback2);
   EXPECT_EQ(ERR_IO_PENDING, rv);
   rv = callback2.WaitForResult();
   EXPECT_EQ(OK, rv);
@@ -3835,7 +3838,7 @@ TEST_F(HttpNetworkTransactionTest, WrongAuthIdentityInURL) {
   EXPECT_TRUE(CheckBasicServerAuth(response->auth_challenge.get()));
 
   TestOldCompletionCallback callback3;
-  rv = trans->RestartWithAuth(kFoo, kBar, &callback3);
+  rv = trans->RestartWithAuth(AuthCredentials(kFoo, kBar), &callback3);
   EXPECT_EQ(ERR_IO_PENDING, rv);
   rv = callback3.WaitForResult();
   EXPECT_EQ(OK, rv);
@@ -3916,7 +3919,7 @@ TEST_F(HttpNetworkTransactionTest, BasicAuthCacheAndPreauth) {
 
     TestOldCompletionCallback callback2;
 
-    rv = trans->RestartWithAuth(kFoo, kBar, &callback2);
+    rv = trans->RestartWithAuth(AuthCredentials(kFoo, kBar), &callback2);
     EXPECT_EQ(ERR_IO_PENDING, rv);
 
     rv = callback2.WaitForResult();
@@ -3999,7 +4002,7 @@ TEST_F(HttpNetworkTransactionTest, BasicAuthCacheAndPreauth) {
 
     TestOldCompletionCallback callback2;
 
-    rv = trans->RestartWithAuth(kFoo2, kBar2, &callback2);
+    rv = trans->RestartWithAuth(AuthCredentials(kFoo2, kBar2), &callback2);
     EXPECT_EQ(ERR_IO_PENDING, rv);
 
     rv = callback2.WaitForResult();
@@ -4115,7 +4118,7 @@ TEST_F(HttpNetworkTransactionTest, BasicAuthCacheAndPreauth) {
 
     EXPECT_TRUE(trans->IsReadyToRestartForAuth());
     TestOldCompletionCallback callback2;
-    rv = trans->RestartWithAuth(string16(), string16(), &callback2);
+    rv = trans->RestartWithAuth(AuthCredentials(), &callback2);
     EXPECT_EQ(ERR_IO_PENDING, rv);
     rv = callback2.WaitForResult();
     EXPECT_EQ(OK, rv);
@@ -4204,7 +4207,7 @@ TEST_F(HttpNetworkTransactionTest, BasicAuthCacheAndPreauth) {
 
     EXPECT_TRUE(trans->IsReadyToRestartForAuth());
     TestOldCompletionCallback callback2;
-    rv = trans->RestartWithAuth(string16(), string16(), &callback2);
+    rv = trans->RestartWithAuth(AuthCredentials(), &callback2);
     EXPECT_EQ(ERR_IO_PENDING, rv);
     rv = callback2.WaitForResult();
     EXPECT_EQ(OK, rv);
@@ -4216,7 +4219,7 @@ TEST_F(HttpNetworkTransactionTest, BasicAuthCacheAndPreauth) {
 
     TestOldCompletionCallback callback3;
 
-    rv = trans->RestartWithAuth(kFoo3, kBar3, &callback3);
+    rv = trans->RestartWithAuth(AuthCredentials(kFoo3, kBar3), &callback3);
     EXPECT_EQ(ERR_IO_PENDING, rv);
 
     rv = callback3.WaitForResult();
@@ -4301,7 +4304,7 @@ TEST_F(HttpNetworkTransactionTest, DigestPreAuthNonceCount) {
 
     TestOldCompletionCallback callback2;
 
-    rv = trans->RestartWithAuth(kFoo, kBar, &callback2);
+    rv = trans->RestartWithAuth(AuthCredentials(kFoo, kBar), &callback2);
     EXPECT_EQ(ERR_IO_PENDING, rv);
 
     rv = callback2.WaitForResult();
@@ -6075,7 +6078,7 @@ TEST_F(HttpNetworkTransactionTest, DrainResetOK) {
 
   TestOldCompletionCallback callback2;
 
-  rv = trans->RestartWithAuth(kFoo, kBar, &callback2);
+  rv = trans->RestartWithAuth(AuthCredentials(kFoo, kBar), &callback2);
   EXPECT_EQ(ERR_IO_PENDING, rv);
 
   rv = callback2.WaitForResult();
@@ -6338,7 +6341,7 @@ TEST_F(HttpNetworkTransactionTest, UnreadableUploadFileAfterAuthRestart) {
 
   TestOldCompletionCallback callback2;
 
-  rv = trans->RestartWithAuth(kFoo, kBar, &callback2);
+  rv = trans->RestartWithAuth(AuthCredentials(kFoo, kBar), &callback2);
   EXPECT_EQ(ERR_IO_PENDING, rv);
 
   rv = callback2.WaitForResult();
@@ -6461,7 +6464,7 @@ TEST_F(HttpNetworkTransactionTest, ChangeAuthRealms) {
   // password prompt for second_realm waiting to be filled in after the
   // transaction completes.
   TestOldCompletionCallback callback2;
-  rv = trans->RestartWithAuth(kFirst, kBaz, &callback2);
+  rv = trans->RestartWithAuth(AuthCredentials(kFirst, kBaz), &callback2);
   EXPECT_EQ(ERR_IO_PENDING, rv);
   rv = callback2.WaitForResult();
   EXPECT_EQ(OK, rv);
@@ -6479,7 +6482,7 @@ TEST_F(HttpNetworkTransactionTest, ChangeAuthRealms) {
   // prompt is not present, it indicates that the HttpAuthCacheEntry for
   // first_realm was not correctly removed.
   TestOldCompletionCallback callback3;
-  rv = trans->RestartWithAuth(kSecond, kFou, &callback3);
+  rv = trans->RestartWithAuth(AuthCredentials(kSecond, kFou), &callback3);
   EXPECT_EQ(ERR_IO_PENDING, rv);
   rv = callback3.WaitForResult();
   EXPECT_EQ(OK, rv);
@@ -6494,7 +6497,7 @@ TEST_F(HttpNetworkTransactionTest, ChangeAuthRealms) {
 
   // Issue the fourth request with the correct password and username.
   TestOldCompletionCallback callback4;
-  rv = trans->RestartWithAuth(kFirst, kBar, &callback4);
+  rv = trans->RestartWithAuth(AuthCredentials(kFirst, kBar), &callback4);
   EXPECT_EQ(ERR_IO_PENDING, rv);
   rv = callback4.WaitForResult();
   EXPECT_EQ(OK, rv);
@@ -7760,7 +7763,7 @@ TEST_F(HttpNetworkTransactionTest, GenerateAuthToken) {
       if (round == 0) {
         rv = trans.Start(&request, &callback, BoundNetLog());
       } else {
-        rv = trans.RestartWithAuth(kFoo, kBar, &callback);
+        rv = trans.RestartWithAuth(AuthCredentials(kFoo, kBar), &callback);
       }
       if (rv == ERR_IO_PENDING)
         rv = callback.WaitForResult();
@@ -7907,7 +7910,7 @@ TEST_F(HttpNetworkTransactionTest, MultiRoundAuth) {
 
   // Second round of authentication.
   auth_handler->SetGenerateExpectation(false, OK);
-  rv = trans->RestartWithAuth(kFoo, kBar, &callback);
+  rv = trans->RestartWithAuth(AuthCredentials(kFoo, kBar), &callback);
   if (rv == ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(OK, rv);
@@ -7918,7 +7921,7 @@ TEST_F(HttpNetworkTransactionTest, MultiRoundAuth) {
 
   // Third round of authentication.
   auth_handler->SetGenerateExpectation(false, OK);
-  rv = trans->RestartWithAuth(string16(), string16(), &callback);
+  rv = trans->RestartWithAuth(AuthCredentials(), &callback);
   if (rv == ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(OK, rv);
@@ -7929,7 +7932,7 @@ TEST_F(HttpNetworkTransactionTest, MultiRoundAuth) {
 
   // Fourth round of authentication, which completes successfully.
   auth_handler->SetGenerateExpectation(false, OK);
-  rv = trans->RestartWithAuth(string16(), string16(), &callback);
+  rv = trans->RestartWithAuth(AuthCredentials(), &callback);
   if (rv == ERR_IO_PENDING)
     rv = callback.WaitForResult();
   EXPECT_EQ(OK, rv);
@@ -8322,7 +8325,7 @@ TEST_F(HttpNetworkTransactionTest, SpdyAlternateProtocolThroughProxy) {
 
   // Restart with auth. Tunnel should work and response received.
   TestOldCompletionCallback callback_3;
-  rv = trans_2->RestartWithAuth(kFoo, kBar, &callback_3);
+  rv = trans_2->RestartWithAuth(AuthCredentials(kFoo, kBar), &callback_3);
   EXPECT_EQ(ERR_IO_PENDING, rv);
   EXPECT_EQ(OK, callback_3.WaitForResult());
 
diff --git a/net/http/http_proxy_client_socket_pool_unittest.cc b/net/http/http_proxy_client_socket_pool_unittest.cc
index 4c42e8d..501b325 100644
--- a/net/http/http_proxy_client_socket_pool_unittest.cc
+++ b/net/http/http_proxy_client_socket_pool_unittest.cc
@@ -102,8 +102,7 @@ class HttpProxyClientSocketPoolTest : public TestWithHttpParam {
                                      "MyRealm1",
                                      HttpAuth::AUTH_SCHEME_BASIC,
                                      "Basic realm=MyRealm1",
-                                     kFoo,
-                                     kBar,
+                                     AuthCredentials(kFoo, kBar),
                                      "/");
   }
 
diff --git a/net/http/http_stream_factory.h b/net/http/http_stream_factory.h
index 31e0cc1..913ad38 100644
--- a/net/http/http_stream_factory.h
+++ b/net/http/http_stream_factory.h
@@ -19,6 +19,7 @@ class GURL;
 
 namespace net {
 
+class AuthCredentials;
 class BoundNetLog;
 class HostMappingRules;
 class HostPortPair;
@@ -132,8 +133,8 @@ class NET_EXPORT_PRIVATE HttpStreamRequest {
   // will have been called.  It now becomes the delegate's responsibility
   // to collect the necessary credentials, and then call this method to
   // resume the HttpStream creation process.
-  virtual int RestartTunnelWithProxyAuth(const string16& username,
-                                         const string16& password) = 0;
+  virtual int RestartTunnelWithProxyAuth(
+      const AuthCredentials& credentials) = 0;
 
   // Returns the LoadState for the request.
   virtual LoadState GetLoadState() const = 0;
diff --git a/net/http/http_stream_factory_impl_job.cc b/net/http/http_stream_factory_impl_job.cc
index edf83f6..66c3135 100644
--- a/net/http/http_stream_factory_impl_job.cc
+++ b/net/http/http_stream_factory_impl_job.cc
@@ -142,7 +142,7 @@ int HttpStreamFactoryImpl::Job::Preconnect(int num_streams) {
 }
 
 int HttpStreamFactoryImpl::Job::RestartTunnelWithProxyAuth(
-    const string16& username, const string16& password) {
+    const AuthCredentials& credentials) {
   DCHECK(establishing_tunnel_);
   next_state_ = STATE_RESTART_TUNNEL_AUTH;
   stream_.reset();
diff --git a/net/http/http_stream_factory_impl_job.h b/net/http/http_stream_factory_impl_job.h
index c1c4140..9b38dc4 100644
--- a/net/http/http_stream_factory_impl_job.h
+++ b/net/http/http_stream_factory_impl_job.h
@@ -50,8 +50,7 @@ class HttpStreamFactoryImpl::Job {
   // appropriate ClientSocketPool.
   int Preconnect(int num_streams);
 
-  int RestartTunnelWithProxyAuth(const string16& username,
-                                 const string16& password);
+  int RestartTunnelWithProxyAuth(const AuthCredentials& credentials);
   LoadState GetLoadState() const;
 
   // Marks this Job as the "alternate" job, from Alternate-Protocol. Tracks the
diff --git a/net/http/http_stream_factory_impl_request.cc b/net/http/http_stream_factory_impl_request.cc
index 17c717e..493aa43 100644
--- a/net/http/http_stream_factory_impl_request.cc
+++ b/net/http/http_stream_factory_impl_request.cc
@@ -196,10 +196,9 @@ void HttpStreamFactoryImpl::Request::OnHttpsProxyTunnelResponse(
 }
 
 int HttpStreamFactoryImpl::Request::RestartTunnelWithProxyAuth(
-    const string16& username,
-    const string16& password) {
+    const AuthCredentials& credentials) {
   DCHECK(bound_job_.get());
-  return bound_job_->RestartTunnelWithProxyAuth(username, password);
+  return bound_job_->RestartTunnelWithProxyAuth(credentials);
 }
 
 LoadState HttpStreamFactoryImpl::Request::GetLoadState() const {
diff --git a/net/http/http_stream_factory_impl_request.h b/net/http/http_stream_factory_impl_request.h
index da81b73..3a6bcc0 100644
--- a/net/http/http_stream_factory_impl_request.h
+++ b/net/http/http_stream_factory_impl_request.h
@@ -88,8 +88,7 @@ class HttpStreamFactoryImpl::Request : public HttpStreamRequest {
 
   // HttpStreamRequest methods.
 
-  virtual int RestartTunnelWithProxyAuth(const string16& username,
-                                         const string16& password);
+  virtual int RestartTunnelWithProxyAuth(const AuthCredentials& credentials);
   virtual LoadState GetLoadState() const;
   virtual bool was_npn_negotiated() const;
   virtual bool using_spdy() const;
diff --git a/net/http/http_transaction.h b/net/http/http_transaction.h
index 3478da2..40be470 100644
--- a/net/http/http_transaction.h
+++ b/net/http/http_transaction.h
@@ -6,13 +6,13 @@
 #define NET_HTTP_HTTP_TRANSACTION_H_
 #pragma once
 
-#include "base/string16.h"
 #include "net/base/completion_callback.h"
 #include "net/base/load_states.h"
 #include "net/base/net_export.h"
 
 namespace net {
 
+class AuthCredentials;
 class BoundNetLog;
 struct HttpRequestInfo;
 class HttpResponseInfo;
@@ -63,8 +63,7 @@ class NET_EXPORT_PRIVATE HttpTransaction {
                                      OldCompletionCallback* callback) = 0;
 
   // Restarts the HTTP transaction with authentication credentials.
-  virtual int RestartWithAuth(const string16& username,
-                              const string16& password,
+  virtual int RestartWithAuth(const AuthCredentials& credentials,
                               OldCompletionCallback* callback) = 0;
 
   // Returns true if auth is ready to be continued. Callers should check
diff --git a/net/http/http_transaction_unittest.cc b/net/http/http_transaction_unittest.cc
index 40ea6f0..ff86bc1 100644
--- a/net/http/http_transaction_unittest.cc
+++ b/net/http/http_transaction_unittest.cc
@@ -271,9 +271,9 @@ int MockNetworkTransaction::RestartWithCertificate(
   return net::ERR_FAILED;
 }
 
-int MockNetworkTransaction::RestartWithAuth(const string16& username,
-                                            const string16& password,
-                                            net::OldCompletionCallback* callback) {
+int MockNetworkTransaction::RestartWithAuth(
+    const net::AuthCredentials& credentials,
+    net::OldCompletionCallback* callback) {
   return net::ERR_FAILED;
 }
 
diff --git a/net/http/http_transaction_unittest.h b/net/http/http_transaction_unittest.h
index 825ea53..d88b8b3 100644
--- a/net/http/http_transaction_unittest.h
+++ b/net/http/http_transaction_unittest.h
@@ -160,31 +160,33 @@ class MockNetworkTransaction : public net::HttpTransaction {
 
   virtual int Start(const net::HttpRequestInfo* request,
                     net::OldCompletionCallback* callback,
-                    const net::BoundNetLog& net_log);
+                    const net::BoundNetLog& net_log) OVERRIDE;
 
-  virtual int RestartIgnoringLastError(net::OldCompletionCallback* callback);
+  virtual int RestartIgnoringLastError(
+      net::OldCompletionCallback* callback) OVERRIDE;
 
-  virtual int RestartWithCertificate(net::X509Certificate* client_cert,
-                                     net::OldCompletionCallback* callback);
+  virtual int RestartWithCertificate(
+      net::X509Certificate* client_cert,
+      net::OldCompletionCallback* callback) OVERRIDE;
 
-  virtual int RestartWithAuth(const string16& username,
-                              const string16& password,
-                              net::OldCompletionCallback* callback);
+  virtual int RestartWithAuth(
+      const net::AuthCredentials& credentials,
+      net::OldCompletionCallback* callback) OVERRIDE;
 
-  virtual bool IsReadyToRestartForAuth();
+  virtual bool IsReadyToRestartForAuth() OVERRIDE;
 
   virtual int Read(net::IOBuffer* buf, int buf_len,
-                   net::OldCompletionCallback* callback);
+                   net::OldCompletionCallback* callback) OVERRIDE;
 
-  virtual void StopCaching();
+  virtual void StopCaching() OVERRIDE;
 
-  virtual void DoneReading();
+  virtual void DoneReading() OVERRIDE;
 
-  virtual const net::HttpResponseInfo* GetResponseInfo() const;
+  virtual const net::HttpResponseInfo* GetResponseInfo() const OVERRIDE;
 
-  virtual net::LoadState GetLoadState() const;
+  virtual net::LoadState GetLoadState() const OVERRIDE;
 
-  virtual uint64 GetUploadProgress() const;
+  virtual uint64 GetUploadProgress() const OVERRIDE;
 
  private:
   void CallbackLater(net::OldCompletionCallback* callback, int result);
diff --git a/net/net.gyp b/net/net.gyp
index 11af8a4..a6fd6ed 100644
--- a/net/net.gyp
+++ b/net/net.gyp
@@ -252,6 +252,8 @@
         'base/x509_util_nss.h',
         'base/x509_util_openssl.cc',
         'base/x509_util_openssl.h',
+        'base/zap.cc',
+        'base/zap.h',
         'disk_cache/addr.cc',
         'disk_cache/addr.h',
         'disk_cache/backend_impl.cc',
diff --git a/net/socket/ssl_client_socket_pool_unittest.cc b/net/socket/ssl_client_socket_pool_unittest.cc
index d10b2e0..b78297c 100644
--- a/net/socket/ssl_client_socket_pool_unittest.cc
+++ b/net/socket/ssl_client_socket_pool_unittest.cc
@@ -128,8 +128,7 @@ class SSLClientSocketPoolTest : public testing::Test {
                                      "MyRealm1",
                                      HttpAuth::AUTH_SCHEME_BASIC,
                                      "Basic realm=MyRealm1",
-                                     kFoo,
-                                     kBar,
+                                     AuthCredentials(kFoo, kBar),
                                      "/");
   }
 
diff --git a/net/socket_stream/socket_stream.cc b/net/socket_stream/socket_stream.cc
index cb8f097..9af48f4 100644
--- a/net/socket_stream/socket_stream.cc
+++ b/net/socket_stream/socket_stream.cc
@@ -206,8 +206,7 @@ void SocketStream::Close() {
       NewRunnableMethod(this, &SocketStream::DoClose));
 }
 
-void SocketStream::RestartWithAuth(
-    const string16& username, const string16& password) {
+void SocketStream::RestartWithAuth(const AuthCredentials& credentials) {
   DCHECK(MessageLoop::current()) <<
       "The current MessageLoop must exist";
   DCHECK_EQ(MessageLoop::TYPE_IO, MessageLoop::current()->type()) <<
@@ -219,11 +218,10 @@ void SocketStream::RestartWithAuth(
   }
 
   if (auth_identity_.invalid) {
-    // Update the username/password.
+    // Update the credentials.
     auth_identity_.source = HttpAuth::IDENT_SRC_EXTERNAL;
     auth_identity_.invalid = false;
-    auth_identity_.username = username;
-    auth_identity_.password = password;
+    auth_identity_.credentials = credentials;
   }
 
   MessageLoop::current()->PostTask(
@@ -713,8 +711,7 @@ int SocketStream::DoWriteTunnelHeaders() {
         if (rv_create == OK) {
           auth_identity_.source = HttpAuth::IDENT_SRC_PATH_LOOKUP;
           auth_identity_.invalid = false;
-          auth_identity_.username = entry->username();
-          auth_identity_.password = entry->password();
+          auth_identity_.credentials = AuthCredentials();
           auth_handler_.swap(handler_preemptive);
         }
       }
@@ -728,8 +725,7 @@ int SocketStream::DoWriteTunnelHeaders() {
       HttpRequestInfo request_info;
       std::string auth_token;
       int rv = auth_handler_->GenerateAuthToken(
-          &auth_identity_.username,
-          &auth_identity_.password,
+          &auth_identity_.credentials,
           &request_info,
           NULL,
           &auth_token);
@@ -1061,8 +1057,7 @@ int SocketStream::HandleAuthChallenge(const HttpResponseHeaders* headers) {
       auth_cache_.Remove(auth_origin,
                          auth_handler_->realm(),
                          auth_handler_->auth_scheme(),
-                         auth_identity_.username,
-                         auth_identity_.password);
+                         auth_identity_.credentials);
     auth_handler_.reset();
     auth_identity_ = HttpAuth::Identity();
   }
@@ -1085,8 +1080,7 @@ int SocketStream::HandleAuthChallenge(const HttpResponseHeaders* headers) {
     if (entry) {
       auth_identity_.source = HttpAuth::IDENT_SRC_REALM_LOOKUP;
       auth_identity_.invalid = false;
-      auth_identity_.username = entry->username();
-      auth_identity_.password = entry->password();
+      auth_identity_.credentials = AuthCredentials();
       // Restart with auth info.
     }
     return ERR_PROXY_AUTH_UNSUPPORTED;
@@ -1156,8 +1150,7 @@ void SocketStream::DoRestartWithAuth() {
                   auth_handler_->realm(),
                   auth_handler_->auth_scheme(),
                   auth_handler_->challenge(),
-                  auth_identity_.username,
-                  auth_identity_.password,
+                  auth_identity_.credentials,
                   std::string());
 
   tunnel_request_headers_ = NULL;
diff --git a/net/socket_stream/socket_stream.h b/net/socket_stream/socket_stream.h
index 2a4f0d7..9539ca6 100644
--- a/net/socket_stream/socket_stream.h
+++ b/net/socket_stream/socket_stream.h
@@ -13,7 +13,6 @@
 #include "base/memory/linked_ptr.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
-#include "base/string16.h"
 #include "base/task.h"
 #include "net/base/address_list.h"
 #include "net/base/completion_callback.h"
@@ -151,9 +150,7 @@ class NET_EXPORT SocketStream
 
   // Restarts with authentication info.
   // Should be used for response of OnAuthRequired.
-  virtual void RestartWithAuth(
-      const string16& username,
-      const string16& password);
+  virtual void RestartWithAuth(const AuthCredentials& credentials);
 
   // Detach delegate.  Call before delegate is deleted.
   // Once delegate is detached, close the socket stream and never call delegate
diff --git a/net/socket_stream/socket_stream_job.cc b/net/socket_stream/socket_stream_job.cc
index cfbea3e..64386eb 100644
--- a/net/socket_stream/socket_stream_job.cc
+++ b/net/socket_stream/socket_stream_job.cc
@@ -62,9 +62,8 @@ void SocketStreamJob::Close() {
   socket_->Close();
 }
 
-void SocketStreamJob::RestartWithAuth(const string16& username,
-                                      const string16& password) {
-  socket_->RestartWithAuth(username, password);
+void SocketStreamJob::RestartWithAuth(const AuthCredentials& credentials) {
+  socket_->RestartWithAuth(credentials);
 }
 
 void SocketStreamJob::DetachDelegate() {
diff --git a/net/socket_stream/socket_stream_job.h b/net/socket_stream/socket_stream_job.h
index 0b87c1a..039b933 100644
--- a/net/socket_stream/socket_stream_job.h
+++ b/net/socket_stream/socket_stream_job.h
@@ -9,7 +9,6 @@
 #include <string>
 
 #include "base/memory/ref_counted.h"
-#include "base/string16.h"
 #include "net/base/net_export.h"
 #include "net/socket_stream/socket_stream.h"
 
@@ -63,8 +62,7 @@ class NET_EXPORT SocketStreamJob
 
   virtual void Close();
 
-  virtual void RestartWithAuth(const string16& username,
-                               const string16& password);
+  virtual void RestartWithAuth(const AuthCredentials& credentials);
 
   virtual void DetachDelegate();
 
diff --git a/net/socket_stream/socket_stream_unittest.cc b/net/socket_stream/socket_stream_unittest.cc
index cbdd6ed..3732498 100644
--- a/net/socket_stream/socket_stream_unittest.cc
+++ b/net/socket_stream/socket_stream_unittest.cc
@@ -144,14 +144,12 @@ class SocketStreamEventRecorder : public net::SocketStream::Delegate {
     event->socket->Close();
   }
   void DoRestartWithAuth(SocketStreamEvent* event) {
-    VLOG(1) << "RestartWithAuth username=" << username_
-            << " password=" << password_;
-    event->socket->RestartWithAuth(username_, password_);
+    VLOG(1) << "RestartWithAuth username=" << credentials_.username()
+            << " password=" << credentials_.password();
+    event->socket->RestartWithAuth(credentials_);
   }
-  void SetAuthInfo(const string16& username,
-                   const string16& password) {
-    username_ = username;
-    password_ = password;
+  void SetAuthInfo(const net::AuthCredentials& credentials) {
+    credentials_ = credentials;
   }
   void CompleteConnection(int result) {
     connection_callback_->Run(result);
@@ -172,9 +170,7 @@ class SocketStreamEventRecorder : public net::SocketStream::Delegate {
   base::Callback<void(SocketStreamEvent*)> on_error_;
   net::OldCompletionCallback* callback_;
   net::OldCompletionCallback* connection_callback_;
-
-  string16 username_;
-  string16 password_;
+  net::AuthCredentials credentials_;
 
   DISALLOW_COPY_AND_ASSIGN(SocketStreamEventRecorder);
 };
@@ -374,7 +370,8 @@ TEST_F(SocketStreamTest, BasicAuthProxy) {
       new SocketStreamEventRecorder(&callback));
   delegate->SetOnConnected(base::Bind(&SocketStreamEventRecorder::DoClose,
                                       base::Unretained(delegate.get())));
-  delegate->SetAuthInfo(ASCIIToUTF16("foo"), ASCIIToUTF16("bar"));
+  delegate->SetAuthInfo(net::AuthCredentials(ASCIIToUTF16("foo"),
+                                             ASCIIToUTF16("bar")));
   delegate->SetOnAuthRequired(base::Bind(
       &SocketStreamEventRecorder::DoRestartWithAuth,
       base::Unretained(delegate.get())));
diff --git a/net/spdy/spdy_network_transaction_unittest.cc b/net/spdy/spdy_network_transaction_unittest.cc
index e51c4a5..bcc8201 100644
--- a/net/spdy/spdy_network_transaction_unittest.cc
+++ b/net/spdy/spdy_network_transaction_unittest.cc
@@ -4935,10 +4935,9 @@ TEST_P(SpdyNetworkTransactionTest, SpdyBasicAuth) {
   EXPECT_EQ("MyRealm", auth_challenge->realm);
 
   // Restart with a username/password.
-  const string16 kFoo(ASCIIToUTF16("foo"));
-  const string16 kBar(ASCIIToUTF16("bar"));
+  AuthCredentials credentials(ASCIIToUTF16("foo"), ASCIIToUTF16("bar"));
   TestOldCompletionCallback callback_restart;
-  const int rv_restart = trans->RestartWithAuth(kFoo, kBar, &callback_restart);
+  const int rv_restart = trans->RestartWithAuth(credentials, &callback_restart);
   EXPECT_EQ(ERR_IO_PENDING, rv_restart);
   const int rv_restart_complete = callback_restart.WaitForResult();
   EXPECT_EQ(OK, rv_restart_complete);
diff --git a/net/spdy/spdy_proxy_client_socket_unittest.cc b/net/spdy/spdy_proxy_client_socket_unittest.cc
index c54e9c7..1da1004 100644
--- a/net/spdy/spdy_proxy_client_socket_unittest.cc
+++ b/net/spdy/spdy_proxy_client_socket_unittest.cc
@@ -89,8 +89,7 @@ class SpdyProxyClientSocketTest : public PlatformTest {
                                      "MyRealm1",
                                      HttpAuth::AUTH_SCHEME_BASIC,
                                      "Basic realm=MyRealm1",
-                                     kFoo,
-                                     kBar,
+                                     AuthCredentials(kFoo, kBar),
                                      "/");
   }
 
diff --git a/net/url_request/url_request.cc b/net/url_request/url_request.cc
index b46b6cc..20f0b9c 100644
--- a/net/url_request/url_request.cc
+++ b/net/url_request/url_request.cc
@@ -616,11 +616,11 @@ void URLRequest::FollowDeferredRedirect() {
   job_->FollowDeferredRedirect();
 }
 
-void URLRequest::SetAuth(const string16& username, const string16& password) {
+void URLRequest::SetAuth(const AuthCredentials& credentials) {
   DCHECK(job_);
   DCHECK(job_->NeedsAuth());
 
-  job_->SetAuth(username, password);
+  job_->SetAuth(credentials);
 }
 
 void URLRequest::CancelAuth() {
@@ -819,7 +819,7 @@ void URLRequest::NotifyAuthRequiredComplete(
       break;
 
     case NetworkDelegate::AUTH_REQUIRED_RESPONSE_SET_AUTH:
-      SetAuth(credentials.username, credentials.password);
+      SetAuth(credentials);
       break;
 
     case NetworkDelegate::AUTH_REQUIRED_RESPONSE_CANCEL_AUTH:
diff --git a/net/url_request/url_request.h b/net/url_request/url_request.h
index 6b23f54..712460b 100644
--- a/net/url_request/url_request.h
+++ b/net/url_request/url_request.h
@@ -604,7 +604,7 @@ class NET_EXPORT URLRequest : NON_EXPORTED_BASE(public base::NonThreadSafe) {
   // OnAuthRequired() callback (and only then).
   // SetAuth will reissue the request with the given credentials.
   // CancelAuth will give up and display the error page.
-  void SetAuth(const string16& username, const string16& password);
+  void SetAuth(const AuthCredentials& credentials);
   void CancelAuth();
 
   // This method can be called after the user selects a client certificate to
diff --git a/net/url_request/url_request_ftp_job.cc b/net/url_request/url_request_ftp_job.cc
index b14d88d..669a889 100644
--- a/net/url_request/url_request_ftp_job.cc
+++ b/net/url_request/url_request_ftp_job.cc
@@ -107,9 +107,7 @@ void URLRequestFtpJob::OnStartCompleted(int result) {
     GURL origin = request_->url().GetOrigin();
     if (server_auth_ && server_auth_->state == AUTH_STATE_HAVE_AUTH) {
       request_->context()->ftp_auth_cache()->Remove(
-          origin,
-          server_auth_->credentials.username,
-          server_auth_->credentials.password);
+          origin, server_auth_->credentials);
     } else if (!server_auth_) {
       server_auth_ = new AuthData();
     }
@@ -120,8 +118,7 @@ void URLRequestFtpJob::OnStartCompleted(int result) {
 
     if (cached_auth) {
       // Retry using cached auth data.
-      SetAuth(cached_auth->username,
-              cached_auth->password);
+      SetAuth(cached_auth->credentials);
     } else {
       // Prompt for a username/password.
       NotifyHeadersComplete();
@@ -151,8 +148,7 @@ void URLRequestFtpJob::RestartTransactionWithAuth() {
   // be notifying our consumer asynchronously via OnStartCompleted.
   SetStatus(URLRequestStatus(URLRequestStatus::IO_PENDING, 0));
 
-  int rv = transaction_->RestartWithAuth(server_auth_->credentials.username,
-                                         server_auth_->credentials.password,
+  int rv = transaction_->RestartWithAuth(server_auth_->credentials,
                                          &start_callback_);
   if (rv == ERR_IO_PENDING)
     return;
@@ -203,15 +199,13 @@ void URLRequestFtpJob::GetAuthChallengeInfo(
   result->swap(auth_info);
 }
 
-void URLRequestFtpJob::SetAuth(const string16& username,
-                               const string16& password) {
+void URLRequestFtpJob::SetAuth(const AuthCredentials& credentials) {
   DCHECK(NeedsAuth());
   server_auth_->state = AUTH_STATE_HAVE_AUTH;
-  server_auth_->credentials.username = username;
-  server_auth_->credentials.password = password;
+  server_auth_->credentials = credentials;
 
   request_->context()->ftp_auth_cache()->Add(request_->url().GetOrigin(),
-                                             username, password);
+                                             server_auth_->credentials);
 
   RestartTransactionWithAuth();
 }
diff --git a/net/url_request/url_request_ftp_job.h b/net/url_request/url_request_ftp_job.h
index 1285d7b..5cee887 100644
--- a/net/url_request/url_request_ftp_job.h
+++ b/net/url_request/url_request_ftp_job.h
@@ -8,7 +8,6 @@
 
 #include <string>
 
-#include "base/string16.h"
 #include "base/task.h"
 #include "net/base/auth.h"
 #include "net/base/completion_callback.h"
@@ -46,15 +45,14 @@ class URLRequestFtpJob : public URLRequestJob {
   void LogFtpServerType(char server_type);
 
   // Overridden from URLRequestJob:
-  virtual void Start();
-  virtual void Kill();
-  virtual LoadState GetLoadState() const;
-  virtual bool NeedsAuth();
+  virtual void Start() OVERRIDE;
+  virtual void Kill() OVERRIDE;
+  virtual LoadState GetLoadState() const OVERRIDE;
+  virtual bool NeedsAuth() OVERRIDE;
   virtual void GetAuthChallengeInfo(
-      scoped_refptr<AuthChallengeInfo>* auth_info);
-  virtual void SetAuth(const string16& username,
-                       const string16& password);
-  virtual void CancelAuth();
+      scoped_refptr<AuthChallengeInfo>* auth_info) OVERRIDE;
+  virtual void SetAuth(const AuthCredentials& credentials) OVERRIDE;
+  virtual void CancelAuth() OVERRIDE;
 
   // TODO(ibrar):  Yet to give another look at this function.
   virtual uint64 GetUploadProgress() const;
diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc
index 7e0d8da..7fca837a 100644
--- a/net/url_request/url_request_http_job.cc
+++ b/net/url_request/url_request_http_job.cc
@@ -282,7 +282,7 @@ void URLRequestHttpJob::NotifyHeadersComplete() {
     // URLRequestTestHTTP.BasicAuthWithCookies
     // where OnBeforeSendHeaders -> OnSendHeaders -> OnBeforeSendHeaders
     // occurs.
-    RestartTransactionWithAuth(string16(), string16());
+    RestartTransactionWithAuth(AuthCredentials());
     return;
   }
 
@@ -334,7 +334,7 @@ void URLRequestHttpJob::StartTransactionInternal() {
   // NOTE: This method assumes that request_info_ is already setup properly.
 
   // If we already have a transaction, then we should restart the transaction
-  // with auth provided by username_ and password_.
+  // with auth provided by auth_credentials_.
 
   int rv;
 
@@ -344,9 +344,8 @@ void URLRequestHttpJob::StartTransactionInternal() {
   }
 
   if (transaction_.get()) {
-    rv = transaction_->RestartWithAuth(username_, password_, &start_callback_);
-    username_.clear();
-    password_.clear();
+    rv = transaction_->RestartWithAuth(auth_credentials_, &start_callback_);
+    auth_credentials_ = AuthCredentials();
   } else {
     DCHECK(request_->context());
     DCHECK(request_->context()->http_transaction_factory());
@@ -765,10 +764,8 @@ void URLRequestHttpJob::OnReadCompleted(int result) {
 }
 
 void URLRequestHttpJob::RestartTransactionWithAuth(
-    const string16& username,
-    const string16& password) {
-  username_ = username;
-  password_ = password;
+    const AuthCredentials& credentials) {
+  auth_credentials_ = credentials;
 
   // These will be reset in OnStartCompleted.
   response_info_ = NULL;
@@ -997,8 +994,7 @@ void URLRequestHttpJob::GetAuthChallengeInfo(
   *result = response_info_->auth_challenge;
 }
 
-void URLRequestHttpJob::SetAuth(const string16& username,
-                                const string16& password) {
+void URLRequestHttpJob::SetAuth(const AuthCredentials& credentials) {
   DCHECK(transaction_.get());
 
   // Proxy gets set first, then WWW.
@@ -1009,7 +1005,7 @@ void URLRequestHttpJob::SetAuth(const string16& username,
     server_auth_state_ = AUTH_STATE_HAVE_AUTH;
   }
 
-  RestartTransactionWithAuth(username, password);
+  RestartTransactionWithAuth(credentials);
 }
 
 void URLRequestHttpJob::CancelAuth() {
diff --git a/net/url_request/url_request_http_job.h b/net/url_request/url_request_http_job.h
index d8e8e19..d1594dd 100644
--- a/net/url_request/url_request_http_job.h
+++ b/net/url_request/url_request_http_job.h
@@ -12,7 +12,6 @@
 #include "base/compiler_specific.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/weak_ptr.h"
-#include "base/string16.h"
 #include "base/task.h"
 #include "base/time.h"
 #include "net/base/auth.h"
@@ -62,8 +61,7 @@ class URLRequestHttpJob : public URLRequestJob {
   void OnReadCompleted(int result);
   void NotifyBeforeSendHeadersCallback(int result);
 
-  void RestartTransactionWithAuth(const string16& username,
-                                  const string16& password);
+  void RestartTransactionWithAuth(const AuthCredentials& credentials);
 
   // Overridden from URLRequestJob:
   virtual void SetUpload(UploadData* upload) OVERRIDE;
@@ -82,8 +80,7 @@ class URLRequestHttpJob : public URLRequestJob {
   virtual bool IsSafeRedirect(const GURL& location) OVERRIDE;
   virtual bool NeedsAuth() OVERRIDE;
   virtual void GetAuthChallengeInfo(scoped_refptr<AuthChallengeInfo>*) OVERRIDE;
-  virtual void SetAuth(const string16& username,
-                       const string16& password) OVERRIDE;
+  virtual void SetAuth(const AuthCredentials& credentials) OVERRIDE;
   virtual void CancelAuth() OVERRIDE;
   virtual void ContinueWithCertificate(X509Certificate* client_cert) OVERRIDE;
   virtual void ContinueDespiteLastError() OVERRIDE;
@@ -107,9 +104,7 @@ class URLRequestHttpJob : public URLRequestJob {
   // Auth states for proxy and origin server.
   AuthState proxy_auth_state_;
   AuthState server_auth_state_;
-
-  string16 username_;
-  string16 password_;
+  AuthCredentials auth_credentials_;
 
   OldCompletionCallbackImpl<URLRequestHttpJob> start_callback_;
   OldCompletionCallbackImpl<URLRequestHttpJob> read_callback_;
diff --git a/net/url_request/url_request_job.cc b/net/url_request/url_request_job.cc
index 8390d8c..a9e9627 100644
--- a/net/url_request/url_request_job.cc
+++ b/net/url_request/url_request_job.cc
@@ -153,8 +153,7 @@ void URLRequestJob::GetAuthChallengeInfo(
   NOTREACHED();
 }
 
-void URLRequestJob::SetAuth(const string16& username,
-                            const string16& password) {
+void URLRequestJob::SetAuth(const AuthCredentials& credentials) {
   // This will only be called if NeedsAuth() returns true, in which
   // case the derived class should implement this!
   NOTREACHED();
diff --git a/net/url_request/url_request_job.h b/net/url_request/url_request_job.h
index c219a3a..26d46d4 100644
--- a/net/url_request/url_request_job.h
+++ b/net/url_request/url_request_job.h
@@ -11,7 +11,6 @@
 
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
-#include "base/string16.h"
 #include "base/system_monitor/system_monitor.h"
 #include "base/task.h"
 #include "base/time.h"
@@ -24,6 +23,7 @@
 namespace net {
 
 class AuthChallengeInfo;
+class AuthCredentials;
 class CookieList;
 class CookieOptions;
 class HttpRequestHeaders;
@@ -152,8 +152,7 @@ class NET_EXPORT URLRequestJob : public base::RefCounted<URLRequestJob>,
       scoped_refptr<AuthChallengeInfo>* auth_info);
 
   // Resend the request with authentication credentials.
-  virtual void SetAuth(const string16& username,
-                       const string16& password);
+  virtual void SetAuth(const AuthCredentials& credentials);
 
   // Display the error page without asking for credentials again.
   virtual void CancelAuth();
diff --git a/net/url_request/url_request_test_util.cc b/net/url_request/url_request_test_util.cc
index 768e520..3a75332 100644
--- a/net/url_request/url_request_test_util.cc
+++ b/net/url_request/url_request_test_util.cc
@@ -195,8 +195,8 @@ void TestDelegate::OnReceivedRedirect(net::URLRequest* request,
 void TestDelegate::OnAuthRequired(net::URLRequest* request,
                                   net::AuthChallengeInfo* auth_info) {
   auth_required_ = true;
-  if (!username_.empty() || !password_.empty()) {
-    request->SetAuth(username_, password_);
+  if (!credentials_.Empty()) {
+    request->SetAuth(credentials_);
   } else {
     request->CancelAuth();
   }
diff --git a/net/url_request/url_request_test_util.h b/net/url_request/url_request_test_util.h
index 56a8973..7ad071a 100644
--- a/net/url_request/url_request_test_util.h
+++ b/net/url_request/url_request_test_util.h
@@ -107,8 +107,9 @@ class TestDelegate : public net::URLRequest::Delegate {
     allow_certificate_errors_ = val;
   }
   void set_cookie_options(int o) {cookie_options_bit_mask_ = o; }
-  void set_username(const string16& u) { username_ = u; }
-  void set_password(const string16& p) { password_ = p; }
+  void set_credentials(const net::AuthCredentials& credentials) {
+    credentials_ = credentials;
+  }
 
   // query state
   const std::string& data_received() const { return data_received_; }
@@ -156,9 +157,7 @@ class TestDelegate : public net::URLRequest::Delegate {
   bool quit_on_redirect_;
   bool allow_certificate_errors_;
   int cookie_options_bit_mask_;
-
-  string16 username_;
-  string16 password_;
+  net::AuthCredentials credentials_;
 
   // tracks status of callbacks
   int response_started_count_;
diff --git a/net/url_request/url_request_unittest.cc b/net/url_request/url_request_unittest.cc
index 53ba466..fbd6d27 100644
--- a/net/url_request/url_request_unittest.cc
+++ b/net/url_request/url_request_unittest.cc
@@ -599,8 +599,7 @@ TEST_F(URLRequestTestHTTP, NetworkDelegateOnAuthRequiredSyncNoAction) {
   context->set_network_delegate(&network_delegate);
   context->Init();
 
-  d.set_username(kUser);
-  d.set_password(kSecret);
+  d.set_credentials(AuthCredentials(kUser, kSecret));
 
   {
     GURL url(test_server_.GetURL("auth-basic"));
@@ -629,10 +628,7 @@ TEST_F(URLRequestTestHTTP, NetworkDelegateOnAuthRequiredSyncSetAuth) {
   network_delegate.set_auth_retval(
       NetworkDelegate::AUTH_REQUIRED_RESPONSE_SET_AUTH);
 
-  AuthCredentials auth_credentials;
-  auth_credentials.username = kUser;
-  auth_credentials.password = kSecret;
-  network_delegate.set_auth_credentials(auth_credentials);
+  network_delegate.set_auth_credentials(AuthCredentials(kUser, kSecret));
 
   scoped_refptr<TestURLRequestContext> context(new TestURLRequestContext(true));
   context->set_network_delegate(&network_delegate);
@@ -704,8 +700,7 @@ TEST_F(URLRequestTestHTTP, NetworkDelegateOnAuthRequiredAsyncNoAction) {
   context->set_network_delegate(&network_delegate);
   context->Init();
 
-  d.set_username(kUser);
-  d.set_password(kSecret);
+  d.set_credentials(AuthCredentials(kUser, kSecret));
 
   {
     GURL url(test_server_.GetURL("auth-basic"));
@@ -736,9 +731,7 @@ TEST_F(URLRequestTestHTTP, NetworkDelegateOnAuthRequiredAsyncSetAuth) {
   network_delegate.set_auth_callback_retval(
       NetworkDelegate::AUTH_REQUIRED_RESPONSE_SET_AUTH);
 
-  AuthCredentials auth_credentials;
-  auth_credentials.username = kUser;
-  auth_credentials.password = kSecret;
+  AuthCredentials auth_credentials(kUser, kSecret);
   network_delegate.set_auth_credentials(auth_credentials);
 
   scoped_refptr<TestURLRequestContext> context(new TestURLRequestContext(true));
@@ -1951,8 +1944,7 @@ TEST_F(URLRequestTestHTTP, BasicAuth) {
   // populate the cache
   {
     TestDelegate d;
-    d.set_username(kUser);
-    d.set_password(kSecret);
+    d.set_credentials(AuthCredentials(kUser, kSecret));
 
     URLRequest r(test_server_.GetURL("auth-basic"), &d);
     r.set_context(default_context_);
@@ -1968,8 +1960,7 @@ TEST_F(URLRequestTestHTTP, BasicAuth) {
   // response should be fetched from the cache.
   {
     TestDelegate d;
-    d.set_username(kUser);
-    d.set_password(kSecret);
+    d.set_credentials(AuthCredentials(kUser, kSecret));
 
     URLRequest r(test_server_.GetURL("auth-basic"), &d);
     r.set_context(default_context_);
@@ -2003,8 +1994,7 @@ TEST_F(URLRequestTestHTTP, BasicAuthWithCookies) {
     context->Init();
 
     TestDelegate d;
-    d.set_username(kUser);
-    d.set_password(kSecret);
+    d.set_credentials(AuthCredentials(kUser, kSecret));
 
     URLRequest r(url_requiring_auth, &d);
     r.set_context(context);
@@ -3270,8 +3260,7 @@ TEST_F(URLRequestTestFTP, FLAKY_FTPCheckWrongPasswordRestart) {
   TestDelegate d;
   // Set correct login credentials. The delegate will be asked for them when
   // the initial login with wrong credentials will fail.
-  d.set_username(kChrome);
-  d.set_password(kChrome);
+  d.set_credentials(AuthCredentials(kChrome, kChrome));
   {
     TestURLRequest r(
         test_server_.GetURLWithUserAndPassword("/LICENSE",
@@ -3334,8 +3323,7 @@ TEST_F(URLRequestTestFTP, FLAKY_FTPCheckWrongUserRestart) {
   TestDelegate d;
   // Set correct login credentials. The delegate will be asked for them when
   // the initial login with wrong credentials will fail.
-  d.set_username(kChrome);
-  d.set_password(kChrome);
+  d.set_credentials(AuthCredentials(kChrome, kChrome));
   {
     TestURLRequest r(
         test_server_.GetURLWithUserAndPassword("/LICENSE",
@@ -3420,8 +3408,7 @@ TEST_F(URLRequestTestFTP, FLAKY_FTPCacheLoginBoxCredentials) {
   scoped_ptr<TestDelegate> d(new TestDelegate);
   // Set correct login credentials. The delegate will be asked for them when
   // the initial login with wrong credentials will fail.
-  d->set_username(kChrome);
-  d->set_password(kChrome);
+  d->set_credentials(AuthCredentials(kChrome, kChrome));
   {
     TestURLRequest r(
         test_server_.GetURLWithUserAndPassword("/LICENSE",
diff --git a/net/websockets/websocket_job.cc b/net/websockets/websocket_job.cc
index 18db83c..4c64496 100644
--- a/net/websockets/websocket_job.cc
+++ b/net/websockets/websocket_job.cc
@@ -155,11 +155,9 @@ void WebSocketJob::Close() {
   CloseInternal();
 }
 
-void WebSocketJob::RestartWithAuth(
-    const string16& username,
-    const string16& password) {
+void WebSocketJob::RestartWithAuth(const AuthCredentials& credentials) {
   state_ = CONNECTING;
-  socket_->RestartWithAuth(username, password);
+  socket_->RestartWithAuth(credentials);
 }
 
 void WebSocketJob::DetachDelegate() {
diff --git a/net/websockets/websocket_job.h b/net/websockets/websocket_job.h
index 041cc8a..f3c0ab1 100644
--- a/net/websockets/websocket_job.h
+++ b/net/websockets/websocket_job.h
@@ -10,7 +10,6 @@
 #include <vector>
 
 #include "base/memory/weak_ptr.h"
-#include "base/string16.h"
 #include "net/base/address_list.h"
 #include "net/base/completion_callback.h"
 #include "net/socket_stream/socket_stream_job.h"
@@ -57,9 +56,7 @@ class NET_EXPORT WebSocketJob
   virtual void Connect();
   virtual bool SendData(const char* data, int len);
   virtual void Close();
-  virtual void RestartWithAuth(
-      const string16& username,
-      const string16& password);
+  virtual void RestartWithAuth(const AuthCredentials& credentials);
   virtual void DetachDelegate();
 
   // SocketStream::Delegate methods.
diff --git a/net/websockets/websocket_job_unittest.cc b/net/websockets/websocket_job_unittest.cc
index 131f2d3..6ef777a 100644
--- a/net/websockets/websocket_job_unittest.cc
+++ b/net/websockets/websocket_job_unittest.cc
@@ -41,16 +41,18 @@ class MockSocketStream : public net::SocketStream {
       : SocketStream(url, delegate) {}
   virtual ~MockSocketStream() {}
 
-  virtual void Connect() {}
-  virtual bool SendData(const char* data, int len) {
+  virtual void Connect() OVERRIDE {}
+  virtual bool SendData(const char* data, int len) OVERRIDE {
     sent_data_ += std::string(data, len);
     return true;
   }
 
-  virtual void Close() {}
+  virtual void Close() OVERRIDE {}
   virtual void RestartWithAuth(
-      const string16& username, const string16& password) {}
-  virtual void DetachDelegate() {
+      const net::AuthCredentials& credentials) OVERRIDE {
+  }
+
+  virtual void DetachDelegate() OVERRIDE {
     delegate_ = NULL;
   }