Re: [users@httpd] dealing with IE's block on URLs with password/username

[Joshua Slive <jo...@slive.ca>]

On Mon, 16 Feb 2004, Brian Dessent wrote:

> Alex Moon wrote:
>
> > Microsoft has released a security patch for IE that blocks the use
> > of this syle of address:-
> >
> > http://fredsmith:password@website.com

> > Does anyone have any suggestion on how i can still block IP but
> > allow users from a particlar web site access.    Any ideas would be
> > gratefully recieved.
>
> If Microsoft decides to disable a feature that you depend on, then your
> options really boil down to "use something else" or "disable that
> change", as far as I can tell.  For the former I suggest Mozilla or
> Firefox, for the latter I suggest you read KB834489 for details of how
> to re-enable the old behavior of IE:
> <http://support.microsoft.com/default.aspx?scid=kb;en-us;834489>
>
> If you're looking for some third option that involves no change on the
> client end, then you're going to have to abandon using usernames in the
> URL.  You might be able to get the equivalent functionality with a
> script of some sort that receives the credentials in the query string,
> and performs the authentication in some other way.

Personally, I'm happy MS disabled this.  It was always a dirty hack, not
part of HTTP.  And it made too much darn fun for spammers.

In addition to Brian's suggestion of using a query string, you could also
do simple referer checking.  This, of course, provides no real security,
since anyone can forge a referer.  But using a userid/password in the URL
doesn't provide real security either, so you are no worse off.

It would look something like

SetEnvIf Referer "^http://www.example.com/let_me_in.html" good_referal

<Directory /path/to/protected content>
Order deny,allow
Deny from all
Allow from local.example.com
Allow from env=good_referal
</Directory>

Joshua.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org