Passing username and password in URL

[BCinSC]

Until this morning, I used to be able to add ?login=name&password=password to a URL in IE to automate authentication. Anybody know why this change and how to work around?

 

[MrChad]

Uh, that entirely depends on the site you're accessing and what authentication scheme they are using.

 

[Gunslinger08]

Sounds like whatever site it is disabled querystring authentication and is now using a different method. Probably session variables or cookies. Or, they might even be hashing (encrypting) the passwords passed in the url now.

 

[BCinSC]

It's my own site!?! One change on my system is updates from Microsoft this morning.

 

[Funkertosh]

I know that IE blocks this method:
http://user:Pass@www.url.com

There is a registry tweak that can remove it though.

MS KB Article ID : 834489

 

[ahurtt]

Why on earth would you pass in a userid and password in a query string like that? It is totally NOT secure. . .You are basically sending it in clear text.

 

[BCinSC]

True. but it's no worse than Linux browsers allowing http://user : Pass@website - a feature disabled in IE.

 

[Aves]

Originally posted by: BCinSC
True. but it's no worse than Linux browsers allowing http://user : Pass@website - a feature disabled in IE.

Exactly. In fact, unless the site uses SSL, login info is sent in clear text no matter what.

 

[BCinSC]

So, anybody have insight as to why it no longer works? Other workarounds?

 

[agnitrate]

Perhaps if you actually posted the code for the login script or something like that. How the hell are we supposed to figure it out if you don't show us what it's doing?

Is it hosted by somebody else? Perhaps they changed some settings that now forbid it.
Is it hosted locally by you? Which update did you install that broke the functionality?

You think you would at least give us some idea what the hell you're doing before asking us to blindly fix it.

 

[BCinSC]

It's generic - no specifics required, thus not really "blind" fix. Server didn't change - it's Linux. My desktop, Win2K Pro, received a batch of updates this week from Microsoft and now it does work. I can setup another Win2K box pre-fixes and see what update broke it.