Question regarding bypassing security

[tim almond]

I currently have a system where the client has a login page which has a
SQL server database behind it and does authentication.

The client wants to have a page which can be logged into by passing a
user ID/password into the URL. I also need the system to say that if
there is no user ID/password, it needs to check the session status.

The best approach I can think of is to drop any role requirements off
this page but when the page load, manually do a check on the login
credentials passed in the URL against the database and if OK (or if
there is already a session), create a session and continue.

Any other cleverer ideas than that?

Thanks in advance.

 

[Robbe Morris [C# MVP]]

That is a HUGE security risk. So much so that microsoft.com
won't let you authenticate to windows like that anymore.