Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I believe this is not possible, but someone I know insisted that it works. I don't even know what parameters to try, and I haven't found this documented anywhere.

I tried http://myserver.com/~user=username&password=mypassword but it doesn't work.

Can you confirm that it's not in fact possible to pass the user/pass via HTTP parameters (GET or POST)?

share|improve this question
    
user:pass@example.com –  sam Mar 21 '12 at 11:20
    
@sam - what? How would the complete URL look like? –  ripper234 Mar 21 '12 at 11:24
2  
All in the spec ietf.org/rfc/rfc1738.txt (3.1) –  sam Mar 21 '12 at 13:20
    
@sam - Sorry, I just failed to parse your comment for some reason. –  ripper234 Mar 21 '12 at 14:07

3 Answers 3

up vote 46 down vote accepted

It is indeed not possible to pass the username and password via query parameters in standard HTTP auth. Instead, you use a special URL format, like this: http://username:password@example.com/ -- this sends the credentials in the standard HTTP "Authorization" header.

It's possible that whoever you were speaking to was thinking of a custom module or code that looked at the query parameters and verified the credentials. This isn't standard HTTP auth, though, it's an application-specific thing.

share|improve this answer
    
Thanks, this is just what I was looking for ... it's not critical that it's GET parameters, just that I can craft it into the URL. –  ripper234 Mar 21 '12 at 12:48
    
Nice. Make sure to also encode your password in case it has special characters. Just open your browser's console encode("my&password&"). Returns you the encoded string to use after the username –  Hendrik Jan 7 at 23:30
4  
FYI, the http://username:password@example.com format is no longer supported by either IE or Chrome, wouldn't be surprised if others followed suit if they haven't already. –  T.J. Crowder Jun 20 at 10:31
1  
Actually works fine in Chrome. Only IE is being a spoiled brat. –  Damien Overeem ツ Aug 18 at 13:12
    
@DamienOvereem what version of chrome you on? i'm on mac os x 37 and it does not seem to work for me –  Chris DaMour Aug 27 at 16:23

http://username:password@example.com will works for FireFox, Chrome, Safari BUT not for IE.

Microsoft Knowledge Base

share|improve this answer
    
This capability was removed from Chrome 19+. See code.google.com/p/chromium/issues/detail?id=123150 –  Moshe Katz Oct 31 '13 at 21:07
2  
By my reading of that bug report, it got added back into Chrome 20. Certainly, I'd expect to see a lot of continued complaining about it if it hadn't been. –  womble Jan 10 at 10:08
    
I now requested it for Internet Explorer: connect.microsoft.com/IE/feedback/details/873575/…. Slightly different use-case, but addresses the same issue ;) –  SimonSimCity May 16 at 13:03

Passing authentication parameters in URL deprecated

There is an Authorization header field for this purpose check it here: http header list

How to use it is written here: Basic access authentication

There you can also read that although it is still supported by some browsers the suggested solution of adding the credentials in the url is actually deprecated.

share|improve this answer
    
And how does one go about encoding an Authorization header into a URL? –  womble Jan 10 at 10:09
2  
Isn't that the form you stated was now deprecated? –  womble Jan 14 at 4:37
1  
The question you answered with "There is an Authorization header field for this purpose" was asking how to put authentication parameters into the URL. If you can't encode HTTP header fields into a URL (which you can't), your answer is a non sequitur. –  womble Jan 15 at 22:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.