Username and password in a login link?

[fluvly]

I need to create a login link which includes username and password (taken from an intranet), so that when the user clicks it, he gets automatically logged in the website, without going to the login page.

 

Is it safe to include the username and password in the url?

 

I know nothing about is, and what the most secure way of doing it is. Any help on the matter would be really welcome!

 

[oni-kun]

I need to create a login link which includes username and password (taken from an intranet), so that when the user clicks it, he gets automatically logged in the website, without going to the login page.

 

Is it safe to include the username and password in the url?

 

I know nothing about is, and what the most secure way of doing it is. Any help on the matter would be really welcome!

 

Is their password on the site database?

$_GET['pass'] = md5($_POST['pass']);

 

For example, send the md5 hash and compare it on the actual website. 'if $dbpass = md5($_GET['pass']) ...'

[otuatail]

No this is not secure. You should have your password hashed (MD5) in your DB but it doesn't matter if you pass in the password or the hash. as this can be captured by anyone. Have you thought of cookies?

 

Desmond.

 

[manwhoeatsrats]

I need to create a login link which includes username and password (taken from an intranet), so that when the user clicks it, he gets automatically logged in the website, without going to the login page.

 

Is it safe to include the username and password in the url?

 

I know nothing about is, and what the most secure way of doing it is. Any help on the matter would be really welcome!

Unless your password is hashed with something like md5 I would not recommend sending it as a GET variable, as anyone standing there could see the password. 

If the password is md5, I would not be concerned to much.....of course the URL might be captured because of browser history..

In my opinion it would be better to set it so when the link is clicked it sets a session variable

 

 

[iPixel]

I feel it isnt safe at all hashed or not. If they can see a password hashed or not they can get in using anyones account by recreating their own link with someone elses data. No Go IMHO.

[laffin]

I would have to agree with iPixel, sending username/passwords over a uri is pretty simple in just memorizing the uri, in order to use the account elsewhere.

 

I would take some information, from user records, browser info, ip, and maybe other data to create a md5 token, store this in the user record for lookup.

and also store this into a cookie. so you can lookup the cookie in the user records