userid:password in URL security and problem

[awingnut]

I'm not sure which is the right forum for this question so my apologies if this is not the right one and my thanks if you can redirect me.

Even though I am using SSL, is the useridassword parameters being passed in the clear? That is:

https://userid:password@www.mywebsite.com

or are only the parameters passed as arguments are secure. That is:

https://www.mywebsite.com/?userid=userid&password=password

In any case, if the first is actually secure then is there a way to hide the useridassword so it is not displayed on the browser address line? TIA

 

[ecobb]

Try passing the info via cookies or sessions or possibly even forms instead of through the URL.

Hope This Helps!

Ecobb
- I hate computers!

 

[awingnut]

First my orignal post was messed up. I forgot to wrap it.

Anyway, I don't know how cookies help. Does not authentication require the userid and password in the URL, if it is going to be used?

For the sake of clarity I'll repost my sample URLs:

[URL unfurl="true"]https://userid:password@www.mywebsite.com[/URL]

and

[URL unfurl="true"]https://www.mywebsite.com/?userid=userid&password=password[/URL]

The second method may not be possible due to the nature of the special HTTP server we are trying to use.

 

[ecobb]

The web site will require whatever authentication you design it to use. If you program it to use the url, it will look in the url. If you program it to use cookies, it will look for cookies.

Hope This Helps!

Ecobb
- I hate computers!

 

[awingnut]

It's not that simple. The server is a pseudo HTTP server. It is actually a database server that provides some built-in web capability. This problem exists because of reasons too complicated to explain but basically it only uses the standard userid/password prompt where it puts up an authentication window on the client side. I believe that means we can only bypass that window by supplying the userid/password, using the "useridassword@

http://www.whatever"

format, in the URL. I am not aware of any setup parameters on the database for type of authentication unless there is some standard HTTP way of specifying it as part of the URL.

 

[awingnut]

I was a little side tracked with the last reply and forgot one of my main questions. To repeat:

With 'https' is passing the useridassword in the URL, as part of the host string, secure?