diff --git a/netwerk/protocol/http/nsHttpNTLMAuth.cpp b/netwerk/protocol/http/nsHttpNTLMAuth.cpp
index b7ec0c5017d..248dcca44f1 100644
--- a/netwerk/protocol/http/nsHttpNTLMAuth.cpp
+++ b/netwerk/protocol/http/nsHttpNTLMAuth.cpp
@@ -170,6 +170,10 @@ nsHttpNTLMAuth::ChallengeReceived(nsIHttpAuthenticableChannel* channel,
     nsCOMPtr<nsIAuthModule> module;
 
 #ifdef MOZ_AUTH_EXTENSION
+    // Remembered for GenerateCredentials, which has to tell an identity the
+    // user left empty apart from one it may fill in from the OS.
+    mAllowDefaultCredentials = CanUseDefaultCredentials(channel, isProxyAuth);
+
     // Check to see if we should default to our generic NTLM auth module
     // through UseGenericNTLM. (We use native auth by default if the
     // system provides it.) If *sessionState is non-null, we failed to
@@ -179,8 +183,7 @@ nsHttpNTLMAuth::ChallengeReceived(nsIHttpAuthenticableChannel* channel,
       // Check for approved default credentials hosts and proxies. If
       // *continuationState is non-null, the last authentication attempt
       // failed so skip default credential use.
-      if (!*continuationState &&
-          CanUseDefaultCredentials(channel, isProxyAuth)) {
+      if (!*continuationState && mAllowDefaultCredentials) {
         // Try logging in with the user's default credentials. If
         // successful, |identityInvalid| is false, which will trigger
         // a default credentials attempt once we return.
@@ -281,6 +284,14 @@ nsHttpNTLMAuth::GenerateCredentials(
 
   // initial challenge
   if (aChallenge.Equals("NTLM"_ns, nsCaseInsensitiveCStringComparator)) {
+    // An empty user or password makes nsAuthSSPI::Init authenticate as the
+    // logged-in user, which only CanUseDefaultCredentials() hosts may do.
+    if (mUseNative && !mAllowDefaultCredentials &&
+        (user.IsEmpty() || pass.IsEmpty())) {
+      LOG(("Not using default credentials for an untrusted host\n"));
+      return NS_ERROR_ABORT;
+    }
+
     // NTLM service name format is 'HTTP@host' for both http and https
     nsCOMPtr<nsIURI> uri;
     rv = authChannel->GetURI(getter_AddRefs(uri));
diff --git a/netwerk/protocol/http/nsHttpNTLMAuth.h b/netwerk/protocol/http/nsHttpNTLMAuth.h
index af36849894c..bab7bf3c02c 100644
--- a/netwerk/protocol/http/nsHttpNTLMAuth.h
+++ b/netwerk/protocol/http/nsHttpNTLMAuth.h
@@ -27,6 +27,10 @@ class nsHttpNTLMAuth : public nsIHttpAuthenticator {
   // or the internal one.
   bool mUseNative{false};
 
+  // Whether the prefs let this host use the logged-in user's identity. Set by
+  // ChallengeReceived, read by GenerateCredentials.
+  bool mAllowDefaultCredentials{false};
+
   static StaticRefPtr<nsHttpNTLMAuth> gSingleton;
 };