Login in with just url-arguments
Today I learnt something I had no clue about was possible, how to just use url-arguments to login to a notes database on the web.
The idea is simple:
http://server/names.nsf?Login&Username=ME&Password=Secret&redirect=MyMailFile.
You can read more about it here: http://vinceschuurman.com/home/ndt4.nsf/(LUBlogContent)/200704151737
Stumble It!
Well this works only for basic authentication (browser popup and not for the session authentication (with domcfg.nsf)
No, that’s incorrect. It does work for session based logins. Maybe you are mixing up this approach with the old username:password@http://server URL?
Ups – You are right. I meant the old username:password login URL.
Sorry :)
You’re welcome! :)
And you also can logout using http://server/MyMailFile?logout
To hide username and password in login request you can send them with POST request type instead.
POST http://server/names.nsf?Login HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Username=ME&Password=Secret&redirect=MyMailFile
A slight error in the previous example..
POST /names.nsf?Login HTTP/1.1
Host: http://www.server.com
@Andrei: A cool thing with doing a post instead, without using domcfg!
Payday loans payments news archive….
Payday loans online. Payday loans. Long term payday loans….
Security ISSUE:
For sure the names.nsf?Login&Username=ME&Password=Secret&redirect is NOT safe because it gets LOGGED on the domino server in the domlog.
When someone opens this logfile and searches for the HTTP GETS your user credentials will become available to that person.
SO DO NOT USE this method if you want to keep you user credentials safe.
I am making a tool that keeps you credentials safe and still provide login automation. See: http://ezscript.nl
Like Andrei suggested I am using the HTTP POST for login in (The POST data will NOT BE LOGGED by domino, so your credentials will be safe)
thnx, Leo
Hi
You have one typo, REDIRECT shoud be REDIRECTTO. Now it’s works nicely. Thank you.