building login arguments into a URL

This depends what the authentication method is.

And you need to remember that at the end of the day it is

probably not secure.

Let's say that the it's just a simple form that uses GET method.

Then whoever designed that is probably not too clever (or assumes

no-one else is) because the url would be something like

http://host.domain.sub/mypasswd.cgi?user=ws&pass=nottellingyou

which of course would be logged in the web server's access

log.

If they use basic auth, then you can still pass a URL like:

http://user:pass@host.domain.sub/any-protected-page.html

What gets logged? I don't know.

Then there is a POST method, which is a little out of my league.

Just be aware that if you can "fake it", then:

a) it's not really secure to start with, and

b) you are touching on security, which is not a trivial issue!

ws

jeff loui wrote:

> does anyone know how to create a http request such that you can

> successfully pass username and password via a single URL (to make sign

> in easier)?

at 2007-6-29 2:39:38 >