259

I believe this is not possible, but someone I know insisted that it works. I don't even know what parameters to try, and I haven't found this documented anywhere.

I tried http://myserver.com/~user=username&password=mypassword but it doesn't work.

Can you confirm that it's not in fact possible to pass the user/pass via HTTP parameters (GET or POST)?

Improve this question
5
  • 11
    user:[email protected]
    – user80776
    Mar 21, 2012 at 11:20
  • @sam - what? How would the complete URL look like?
    – ripper234
    Mar 21, 2012 at 11:24
  • 6
    All in the spec ietf.org/rfc/rfc1738.txt (3.1)
    – user80776
    Mar 21, 2012 at 13:20
  • 1
    @sam - Sorry, I just failed to parse your comment for some reason.
    – ripper234
    Mar 21, 2012 at 14:07
  • Even if that would work, it would be a bad security joke: Just bookmark the page and you have very comfortable authentication.
    – U. Windl
    Feb 7, 2023 at 12:20

5 Answers 5

Reset to default
344

It is indeed not possible to pass the username and password via query parameters in standard HTTP auth. Instead, you use a special URL format, like this: http://username:[email protected]/ -- this sends the credentials in the standard HTTP "Authorization" header.

It's possible that whoever you were speaking to was thinking of a custom module or code that looked at the query parameters and verified the credentials. This isn't standard HTTP auth, though, it's an application-specific thing.

Improve this answer
21
  • 65
    FYI, the http://username:[email protected] format is no longer supported by either IE or Chrome, wouldn't be surprised if others followed suit if they haven't already.
    – T.J. Crowder
    Jun 20, 2014 at 10:31
  • 17
    Actually works fine in Chrome. Only IE is being a spoiled brat.
    – Damien Overeem ツ
    Aug 18, 2014 at 13:12
  • 20
    I have since learned that Chrome had it disabled for a time, but re-enabled this feature later. I've also learned that Safari will throw phishing errors when running into these types of links.. Basically the time of url-based http authentication is over..
    – Damien Overeem ツ
    Aug 28, 2014 at 9:20
  • 3
    Basic http auth is a pain, but since it is easy to setup it is unlikely to ever be completely eliminated. Even http 2.0 includes rfc7235 with no mention of deprecation.
    – chicks
    Mar 2, 2015 at 15:11
  • 5
    It may still work but I wouldn't use it for anything other than testing: tools.ietf.org/html/rfc3986 - Use of the format "user:password" in the userinfo field is deprecated.
    – Alex
    Feb 28, 2019 at 12:43
25

http://username:[email protected] will works for FireFox, Chrome, Safari BUT not for IE.

Microsoft Knowledge Base

Improve this answer
7
  • 4
    This capability was removed from Chrome 19+. See code.google.com/p/chromium/issues/detail?id=123150
    – Moshe Katz
    Oct 31, 2013 at 21:07
  • 6
    By my reading of that bug report, it got added back into Chrome 20. Certainly, I'd expect to see a lot of continued complaining about it if it hadn't been.
    – womble ♦
    Jan 10, 2014 at 10:08
  • I now requested it for Internet Explorer: connect.microsoft.com/IE/feedback/details/873575/…. Slightly different use-case, but addresses the same issue ;)
    – SimonSimCity
    May 16, 2014 at 13:03
  • 2
    @Diago if password contains '@' then it doesn't work. it gives fatal error, can anyone tell me how we can give username & password at once
    – Ashish Jain
    Mar 4, 2015 at 7:50
  • 1
    @AshishJain -- I would try escaping the @ in the password as %40. (I don't know if that works, though, and it might depend on the server or browser/server combination.)
    – David Moles
    Apr 14, 2015 at 0:00
23

Passing Basic authentication parameters in URL not recommended

There is an Authorization header field for this purpose check it here: http header list

How to use it is written here: Basic access authentication

There you can also read that although it is still supported by some browsers the suggested solution of adding the Basic authorization credentials in the url is not recommended.

Read also chapter 4.1 in RFC 2617 - HTTP Authentication for more details on why NOT to use Basic Authentication.

Passing authentication parameters in query string

When using OAuth or other authentication services you can often also send your access token in a query string instead of in an authorization header, so something like:

GET https://www.example.com/api/v1/users/1?access_token=1234567890abcdefghijklmnopqrstuvwxyzABCD
Improve this answer
7
  • And how does one go about encoding an Authorization header into a URL?
    – womble ♦
    Jan 10, 2014 at 10:09
  • 2
    Isn't that the form you stated was now deprecated?
    – womble ♦
    Jan 14, 2014 at 4:37
  • 3
    The question you answered with "There is an Authorization header field for this purpose" was asking how to put authentication parameters into the URL. If you can't encode HTTP header fields into a URL (which you can't), your answer is a non sequitur.
    – womble ♦
    Jan 15, 2014 at 22:17
  • Can you cite where in the URI standard says that passing basic authentication parameters in URI is deprecated? RFC 2396 only says that it is "NOT RECOMMENDED" because authentication details in plain text is, in many circumstances, not a good idea (of which I agree), while RFC 7235 mentions nothing. Nowhere in the specs I can search says that it's deprecated.
    – Lie Ryan
    Jul 1, 2015 at 13:21
  • 2
    @Wilt: I have to apologise, you are indeed correct. Your hint that the spec was "altered" instigated me to investigate further (an RFC is never modified once it's published/numbered). I just found that RFC 2396 has actually been superseded by RFC 3986, which I wasn't able to find earlier. RFC 3986 does mention the deprecation of username:password syntax: Use of the format "user:password" in the userinfo field is deprecated.
    – Lie Ryan
    Jul 1, 2015 at 14:19
0

In your example, the URL http://myserver.com/ Would be:

http://username:[email protected]/myserver.com/

As of 12/19/2019 I have tested this and it works for Chrome Firefox Safari

But not for IE, which no longer support basic authentication. I implemented this using SSRS 2017, which hides the username and password. I would recommend you test this with an Incognito Browser. Test with and without the password in different Incognito browsers. The one without the password should ask you for the password.

Improve this answer
1
  • "IE, which no longer support basic authentication." - You mean the passing of user credentials in the userinfo part of the URL. IE still supports "[HTTP] basic authentication". And your example URL should be: http://username:[email protected]/.
    – MrWhite
    Jan 31, 2020 at 20:57
-1

It is (obviously) possible to send any string in the GET parameters, although not recommended to send login and password as can make it highly visible, especially if it's not in an AJAX request.

You will however, need to then code the server page to extract the login and password and then validate and use them in whatever way is required.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .