|
|||||||||
|
|||||||||
| |||||||||
|
|||||||||
|
|||||||||
| |||||||||
|
|
|
| ||||||||||||||||||||||||||||||||
 |
|
|
«
Previous Thread
|
Next Thread
»
|
Thread Tools | Search this Thread | Rate Thread | Display Modes |
Dev Shed Forums Sponsor:
|
|
|
|
#1
June 13th, 2009, 12:58 PM
|
|||
|
|||
|
general - Can I pass username and pw for protected dir as args in URL?
Greetings,
Say I have a file at http://mydomain.com/protectedDir/foo.mp3, where the username for the protected directory is fred and the password is jones. Is it possible to enter the username and password as arguments in the URL typed into the browser's navigation bar, rather than having the browser's log-in dialog come up? If so, what would the names of the args be? I took a shot in the dark and tried entering them as though I were passing args to a CGI script (http://mydomain.com/protectedDir/foo.mp3?username=fred&password=jones) but it didn''t work. Thanks! DM
|
|
#2
June 13th, 2009, 01:28 PM
|
||||||
|
||||||
|
Quote:
Not sure if you can do that directly for a file, but you can for a page that may have a link to the file. Basically doing username=fred&password=jones, you need to have something along these lines on the page you're going to: Code:
<?php $username = $_GET['username']; $password = $_GET['password']; $sql = "SELECT * FROM `table` WHERE `username` = '$username' AND `password` = '$password'"; $result = mysql_query($sql, $conn) or die(mysql_error()); ?> Then you could redirect them or do whatever needs to be done with the code. But basically you need a php page to process the get method for pulling in the info from the URL. Once the variables from the url have been pulled into the page, you can have the code redirect them to the .mp3 file... but other than that, I'm not sure.. someone else may have a better solution for you. This would probably be better in the PHP forum rather than Apache.... (I'm assuming you're using PHP). If you're using something else let me know and I will have this moved to the appropriate forum.
|
|
#3
June 13th, 2009, 06:59 PM
|
||||
|
||||
|
That type of authentication is sent using HTTP headers, not with anything through the URL.
If you want to bypass it then you need another authentication method: like putting the username and password in the URL as hiker suggested.
|
|
#4
June 18th, 2009, 01:25 PM
|
|||
|
|||
|
Although you shouldn't, it is possible.
The format is: Code:
https://username:password@servername.example.com/directory/ That will submit a username/password to HTTP Basic Auth. Also works for ftp from a browser. So, here's why you shouldn't use this: I think MS released a patch for IE that broke this some time ago, so likely only works in Firefox/Safari. Submitting this over anything other than https password the user/pass over cleartext. Storing credentials (like on the webserver holding this page) is a bad idea. It really kinda defeats the purpose of authentication, and makes you susceptible to many other attacks. Last edited by djlarsu : June 18th, 2009 at 01:27 PM. Reason: Hadn't wrapped the format in [code], so it included a smiley
|
|
| Viewing: Dev Shed Forums > System Administration > Apache Development > general - Can I pass username and pw for protected dir as args in URL? |
| Thread Tools | Search this Thread |
| Display Modes | Rate This Thread |
|
|
|
 |
|
|
Del.icio.us
Digg
Google
Spurl
Blink
Furl
Simpy
Y! MyWeb
Linear Mode
