Re: Question regarding bypassing security

That is a HUGE security risk. So much so that microsoft.com
won't let you authenticate to windows like that anymore.

--
2005 Microsoft MVP C#
Robbe Morris
http://www.robbemorris.com
http://www.masterado.net/home/listings.aspx



"tim almond" <vv@iijjhh> wrote in message
news:OWI7FDSPFHA.1884@xxxxxxxxxxxxxxxxxxxxxxx
>I currently have a system where the client has a login page which has a SQL
>server database behind it and does authentication.
>
> The client wants to have a page which can be logged into by passing a user
> ID/password into the URL. I also need the system to say that if there is
> no user ID/password, it needs to check the session status.
>
> The best approach I can think of is to drop any role requirements off this
> page but when the page load, manually do a check on the login credentials
> passed in the URL against the database and if OK (or if there is already a
> session), create a session and continue.
>
> Any other cleverer ideas than that?
>
> Thanks in advance.


.

Relevant Pages

  • Re: [PHP] Back to security
    ... Think of HTTPS as like a bank vault in the basement of a branch bank. ... If you authenticate users outside the steel wall, ... sessionID is compared with the one in DB, ... Compare the output of on the two pages, ...
    (php.general)
  • Refuse Relay to certain authenticated sessions
    ... Currently my sendmail server relays email for my users when they ... connect from their home (Access table allows IP based relaying) and it ... authenticated session. ... should refuse to relay the mails for, even if they authenticate ...
    (comp.mail.sendmail)
  • Re: Read session data of all users
    ... I'm trying to come up with a better way to authenticate a user across ... different web applications from a central place. ... and app3 will be redirected to authenticate with app1 if their session ... or at least get a reference to a HttpSessionState objects ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: how to re-use existing session?
    ... but I had to authenticate to forward the port. ... a session running, although it's in the background. ... I can also remove the -N switch to the initial SSH command, ...
    (comp.security.ssh)
  • VisualStudio 2003 question
    ... I'm relatively new to VisualStudio 2003 and have to create an application ... that uses Web Services to authenticate a user. ... Login page instantiates an object which can also be used to authenticate ... my user (Store the object in Session) ...
    (microsoft.public.dotnet.framework.aspnet)