markwilson.it

Supplying logon credentials within a URL

Written by

Mark Wilson

in

Alex e-mailed me earlier and told me that the RSS feed on my family blog was broken. Actually, I’d password protected the site, and forgotten to update the details in Feedburner (which translates Blogger’s Atom output to RSS for me). I couldn’t find any fields in the feed service settings to supply username and password credentials until an unusually helpful error message suggested that I should enter the URL as http://username:password@domainname/document.extension.

I knew that particular syntax worked for FTP, but not for HTTP too! Of course, if I was really that bothered about security I should secure the site using HTTPS, but in this case, the username and password is only a deterrent and there’s not really anything there that needs SSL security.

Comments

5 responses to “Supplying logon credentials within a URL”

  1. Alex avatar
    Alex

    For some reason, Firefox for Macintosh and Safari don’t appear to allow users to log in that way. Not that you care, with your Microsoft-sponsored blog :)

  2. Mark avatar
    Mark

    If only my blog was sponsored by Microsoft! Unfortunately it is isn’t, but I checked out RFC 2396 which defines the generic syntax for URIs (specifically section 3.2.2) and it seems that the Mozilla-based browsers you are having issues with are not RFC compliant ;-)

    There’s also some interesting reading in the how to obscure any URL page at the PC Help website.

  3. Mark’s (we)Blog » The wonderful thing about web standards

    […] Alex and I were having a rant discussion a few days back about web standards after I pointed out to him that Firefox and Safari not being able to supply login credentials within a URL meant they were not RFC-c…! […]

  4. Anonymous avatar
    Anonymous

    You may like to look back at Microsoft technet articles – they stated that they would remove the ability to supply auth credentials on the URL in MSIE.

    So not sponsored by M$.

  5. Mark avatar
    Mark

    According to Microsoft knowledge base article 834489, a security update is available that modifies the default behaviour of Internet Explorer for handling user information in HTTP and in HTTPS URLs; however, this URL format still works for FTP. In fact, my post about how Internet Explorer displays credentials in the status bar when used as an FTP client shows just how badly it works in FTP!

    On a related note, readers of this post might also be interested in my recent comments about web standards.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

More posts