Login in with just url-arguments

Today I learnt something I had no clue about was possible, how to just use url-arguments to login to a notes database on the web.

The idea is simple:

http://server/names.nsf?Login&Username=ME&Password=Secret&redirect=MyMailFile.

You can read more about it here: http://vinceschuurman.com/home/ndt4.nsf/(LUBlogContent)/200704151737

  • http://ABData.CH Andy Brunner

    Well this works only for basic authentication (browser popup and not for the session authentication (with domcfg.nsf)

  • Joachim Dagerot

    No, that’s incorrect. It does work for session based logins. Maybe you are mixing up this approach with the old username:password@http://server URL?

  • http://ABData.CH Andy Brunner

    Ups – You are right. I meant the old username:password login URL.

    Sorry :)

  • Joachim Dagerot

    You’re welcome! :)

  • http://dominounlimited.blogspot.com Andrei Kouvchinnikov

    And you also can logout using http://server/MyMailFile?logout

    To hide username and password in login request you can send them with POST request type instead.
    POST http://server/names.nsf?Login HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Username=ME&Password=Secret&redirect=MyMailFile

  • http://dominounlimited.blogspot.com Andrei Kouvchinnikov

    A slight error in the previous example..
    POST /names.nsf?Login HTTP/1.1
    Host: http://www.server.com

  • Joachim Dagerot

    @Andrei: A cool thing with doing a post instead, without using domcfg!

  • http://www.imeem.com/people/3PUuV8A/blogs/2008/07/01/aNRPDGHj/payday_loans Fast payday loans.

    Payday loans payments news archive….

    Payday loans online. Payday loans. Long term payday loans….

  • http://ezscript.nl leo

    Security ISSUE:

    For sure the names.nsf?Login&Username=ME&Password=Secret&redirect is NOT safe because it gets LOGGED on the domino server in the domlog.

    When someone opens this logfile and searches for the HTTP GETS your user credentials will become available to that person.

    SO DO NOT USE this method if you want to keep you user credentials safe.

    I am making a tool that keeps you credentials safe and still provide login automation. See: http://ezscript.nl

    Like Andrei suggested I am using the HTTP POST for login in (The POST data will NOT BE LOGGED by domino, so your credentials will be safe)

    thnx, Leo

  • Jafa

    Hi

    You have one typo, REDIRECT shoud be REDIRECTTO. Now it’s works nicely. Thank you.

blog comments powered by Disqus