You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Alex Moon <a....@mdx.ac.uk> on 2004/02/16 13:11:00 UTC
[users@httpd] dealing with IE's block on URLs with password/username
Hi
Microsoft has released a security patch for IE that blocks the use
of this syle of address:-
http://fredsmith:password@website.com
For various reasons I have used this as a means of giving access
to non critical websites that are normally IP protected via an
external website that requires a login. This website has links
containing a generic password that means the user does not
need to type in or even know a password to access the ip
restricted websites.
Does anyone have any suggestion on how i can still block IP but
allow users from a particlar web site access. Any ideas would be
gratefully recieved.
Many Thanks
Al
Technical Manager
Online Learning Support Unit
Middlesex University Business School
a.moon@mdx.ac.uk
020 8411 5092
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] dealing with IE's block on URLs with password/username
Posted by Joshua Slive <jo...@slive.ca>.
On Mon, 16 Feb 2004, Brian Dessent wrote:
> Alex Moon wrote:
>
> > Microsoft has released a security patch for IE that blocks the use
> > of this syle of address:-
> >
> > http://fredsmith:password@website.com
> > Does anyone have any suggestion on how i can still block IP but
> > allow users from a particlar web site access. Any ideas would be
> > gratefully recieved.
>
> If Microsoft decides to disable a feature that you depend on, then your
> options really boil down to "use something else" or "disable that
> change", as far as I can tell. For the former I suggest Mozilla or
> Firefox, for the latter I suggest you read KB834489 for details of how
> to re-enable the old behavior of IE:
> <http://support.microsoft.com/default.aspx?scid=kb;en-us;834489>
>
> If you're looking for some third option that involves no change on the
> client end, then you're going to have to abandon using usernames in the
> URL. You might be able to get the equivalent functionality with a
> script of some sort that receives the credentials in the query string,
> and performs the authentication in some other way.
Personally, I'm happy MS disabled this. It was always a dirty hack, not
part of HTTP. And it made too much darn fun for spammers.
In addition to Brian's suggestion of using a query string, you could also
do simple referer checking. This, of course, provides no real security,
since anyone can forge a referer. But using a userid/password in the URL
doesn't provide real security either, so you are no worse off.
It would look something like
SetEnvIf Referer "^http://www.example.com/let_me_in.html" good_referal
<Directory /path/to/protected content>
Order deny,allow
Deny from all
Allow from local.example.com
Allow from env=good_referal
</Directory>
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] dealing with IE's block on URLs with password/username
Posted by Brian Dessent <br...@dessent.net>.
Alex Moon wrote:
> Microsoft has released a security patch for IE that blocks the use
> of this syle of address:-
>
> http://fredsmith:password@website.com
>
> For various reasons I have used this as a means of giving access
> to non critical websites that are normally IP protected via an
> external website that requires a login. This website has links
> containing a generic password that means the user does not
> need to type in or even know a password to access the ip
> restricted websites.
>
> Does anyone have any suggestion on how i can still block IP but
> allow users from a particlar web site access. Any ideas would be
> gratefully recieved.
If Microsoft decides to disable a feature that you depend on, then your
options really boil down to "use something else" or "disable that
change", as far as I can tell. For the former I suggest Mozilla or
Firefox, for the latter I suggest you read KB834489 for details of how
to re-enable the old behavior of IE:
<http://support.microsoft.com/default.aspx?scid=kb;en-us;834489>
If you're looking for some third option that involves no change on the
client end, then you're going to have to abandon using usernames in the
URL. You might be able to get the equivalent functionality with a
script of some sort that receives the credentials in the query string,
and performs the authentication in some other way.
Brian
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org