fluvly Posted January 22, 2010 Share Posted January 22, 2010 I need to create a login link which includes username and password (taken from an intranet), so that when the user clicks it, he gets automatically logged in the website, without going to the login page. Is it safe to include the username and password in the url? I know nothing about is, and what the most secure way of doing it is. Any help on the matter would be really welcome! Quote Link to comment https://forums.phpfreaks.com/topic/189427-username-and-password-in-a-login-link/ Share on other sites More sharing options...
oni-kun Posted January 22, 2010 Share Posted January 22, 2010 I need to create a login link which includes username and password (taken from an intranet), so that when the user clicks it, he gets automatically logged in the website, without going to the login page. Is it safe to include the username and password in the url? I know nothing about is, and what the most secure way of doing it is. Any help on the matter would be really welcome! Is their password on the site database? $_GET['pass'] = md5($_POST['pass']); For example, send the md5 hash and compare it on the actual website. 'if $dbpass = md5($_GET['pass']) ...' Quote Link to comment https://forums.phpfreaks.com/topic/189427-username-and-password-in-a-login-link/#findComment-999883 Share on other sites More sharing options...
otuatail Posted January 22, 2010 Share Posted January 22, 2010 No this is not secure. You should have your password hashed (MD5) in your DB but it doesn't matter if you pass in the password or the hash. as this can be captured by anyone. Have you thought of cookies? Desmond. Quote Link to comment https://forums.phpfreaks.com/topic/189427-username-and-password-in-a-login-link/#findComment-999923 Share on other sites More sharing options...
manwhoeatsrats Posted January 22, 2010 Share Posted January 22, 2010 I need to create a login link which includes username and password (taken from an intranet), so that when the user clicks it, he gets automatically logged in the website, without going to the login page. Is it safe to include the username and password in the url? I know nothing about is, and what the most secure way of doing it is. Any help on the matter would be really welcome! Unless your password is hashed with something like md5 I would not recommend sending it as a GET variable, as anyone standing there could see the password. If the password is md5, I would not be concerned to much.....of course the URL might be captured because of browser history.. In my opinion it would be better to set it so when the link is clicked it sets a session variable Quote Link to comment https://forums.phpfreaks.com/topic/189427-username-and-password-in-a-login-link/#findComment-999925 Share on other sites More sharing options...
iPixel Posted January 22, 2010 Share Posted January 22, 2010 I feel it isnt safe at all hashed or not. If they can see a password hashed or not they can get in using anyones account by recreating their own link with someone elses data. No Go IMHO. Quote Link to comment https://forums.phpfreaks.com/topic/189427-username-and-password-in-a-login-link/#findComment-999930 Share on other sites More sharing options...
laffin Posted January 24, 2010 Share Posted January 24, 2010 I would have to agree with iPixel, sending username/passwords over a uri is pretty simple in just memorizing the uri, in order to use the account elsewhere. I would take some information, from user records, browser info, ip, and maybe other data to create a md5 token, store this in the user record for lookup. and also store this into a cookie. so you can lookup the cookie in the user records Quote Link to comment https://forums.phpfreaks.com/topic/189427-username-and-password-in-a-login-link/#findComment-1000705 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.