asked on

Using a query string on a link to pass the username and password.

Is there a way to add a query string to a link so that it will automatically log someone in to a site when they click on the link. For example: Internal user on the intranet clicks on a link to say "Experts Exchange". The link will take them to site and log them in with the company user name and password. Thank you in advance for your help.

0h4crying0utloud

I'm not sure I understand your question but here's a shot:

Only if the site has a server program that is looking for those query strings and logging people in. No site that I know would ever do that but you might have your own setup in which case it would work (but pretty insecure since login info is rarely not encrypted).

in any case, you can add any name value pairs to a link which can be easily read by the server:
<a href="http://www.test.com/index.html?name1=value1&name2=value2">test link</a>

GrandSchtroumpf

Login forms are supposed to use POST (not GET), so an url should not work.
But it should be possible to reproduce the login form on your page:
Replace the <input type="text"> with <input type="hidden" value="myvalue">
where "myvalue" correspond to the text you enter in the text input.
Have your form submit to the server's login page and you should be able to login.

arvanhalleorg

if you're using a username and password, the assumption is that you'd want some from of privacy protection. so if you aren't using a form with post/get then you should probably be trying to use a cookie that contains the username/password and set it to expire after x number of hours or days. (with vbscript).

if its just a thing like 'guest' 'general pass' that goes to a lesser protected end of the site (even intranet) then you could do what Oh4cryingOutloud said.
<a href="http://www.test.com/index.html?name1=value1&name2=value2">test link</a>

<a href="file.ext?usr=blah&psw=blah">link</a>

or if anyone can go there anyways, why have with a username/password? just give them a general link maybe?

GrandSchtroumpf

Ok, i'll code it:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title>Test</title>
<style type="text/css">

body {
background-color: #ddd;
color: black;
}

</style>
</head>
<body>

<form method="post" action="https://www.experts-exchange.com/login.jsp">

<input name="msuLoginName" type="hidden" value="jsmaling">
<input name="msuPassword" type="hidden" value="%your password goes here%">
<input name="msuLoginSubmit" type="submit" value="Experts Exchange">

</form>

</body>
</html>

********************************************
This uses an input to submit the form, but you can replace it with a link if you want, just use javascript to submit your form from the link.

DreamMaster

Like a lot of others are saying, you will not find many sites that check for their users using a querystring. I for one, would not visit such a site.

That set aside, you cannot control the other sites (unless they are your own) so there is no way of making sure that you can log in your users automatically. Even IF they would have set up their site to allow logging in using querystring variables, there's still the chance they check for a referrel URL to be their own site, I would do that if it were my site. Again that would render your querystring useless..

So that said, it's possible, but not likely you will get that working.

Regards,
Max.

ASKER CERTIFIED SOLUTION

Willibob

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

jsmaling

ASKER

willibob:

The link is going to be internal and we want our users to have the information without having to remember it. This link actually worked for us. How would I make it go to the homepage instead of the web development page?

GrandSchtroumpf

jsmaling, why not using a form? that's the correct way to do it.

the big problem of sending sensitive data inside an url is that the url gets logged on the webservers, so your password will appear in the webstats reports. also, if you are not correctly redirected and you click on an new link, that url will be sent as "referrer".
So, DO IT WITH A FORM.

Willibob

If you get the url of the page you want to redirect to you can use it as the value for the redirectURL key in the querystring. This is specific to the EE site and is unlikely to work on other sites.

Bill