hyperlink to Bypass login

P

Priya

I would need to provide a hyperlink on my website that would let users
to login automatically with a username and password. Could I do that
with javascript, if yes can someone please direct me to the
documentation that would give the steps of doing so?

Any help is greatly appreciated. Thanks.
 
P

Priya

Yes that is exactly what I am trying to do-pass a username/password to
an existing site, so it would automatically log me in. Can I find some
documentation online, I am a newbie; so any help will be greatly
appreciated. Thank you for all the info.
 
T

Thomas 'PointedEars' Lahn

Priya said:
Yes that is exactly what I am trying to do-pass ^^^^^^^
YSCIB.

a username/password to an existing site, so it would automatically log me
in.

Where "me" is really you, from a local (file://) site on your local system
connected to the Internet, in a Web browser?
Can I find some documentation online,

Yes? (That is not a question either.)
I am a newbie;

And therefore not required to use your brain before posting?

<http://www.catb.org/~esr/faqs/smart-questions.html>
so any help will be greatly appreciated. Thank you for all the info.

To do this, I had created a bookmarklet that uses the `javascript:' scheme
to generate a document that duplicates the form usually used to log in to
the service (with the exception of the `action' attribute, which value must
contain the full URL) that submits itself:

javascript:'<!DOCTYPE html ...><html>...<body
onload="document.forms[0].submit()"><form action="http://..."
method="POST">...</form></body></html>'

It could be rewritten accepting parameters (such as username, password, and
site), or be reused to write a script for any Web site (the Same Origin
Policy does not apply then) that uses DOM scripting to append and submit the
form. If you use the bookmarklet and the login data is hard-coded, you
should make sure that the bookmarks file cannot be accessed by unauthorized
people.

Chances are that the original login form used by the service uses POST, so
you will have to use a form or XHR anyway. A simple link would not suffice,
and it would probably be off-topic here anyway (no scripting necessarily
involved).


PointedEars
 
R

Ry Nohryb

This security-relevant bug has been fixed long ago.  Default security
settings in more recent browsers do not allow that anymore.

In your dreams, may be. I have just tried it out on the latest Safari,
Chrome, Opera, and FireFox, my dear Pointy.
 
T

Thomas 'PointedEars' Lahn

Ry said:
In your dreams, may be. I have just tried it out on the latest Safari,
Chrome, Opera, and FireFox, my dear Pointy.

Microsoft removed the support for thos from IE because of the security
issue.

In Firefox (3.6) you have to set the user preference
"network.http.phishy-userpass-length" from the default 1
to 255 in order to have a good chance that no phishing
warning is displayed.

<http://kb.mozillazine.org/Network.http.phishy-userpass-length>

It is unlikely that it will take other vendors long to take appropriate
measures, so this approach must be recommended against.

And stop calling me "(my dear) Pointy", Georgie-Baby.


PointedEars
 
B

Bwig Zomberi

Priya said:
Yes that is exactly what I am trying to do-pass a username/password to
an existing site, so it would automatically log me in. Can I find some
documentation online, I am a newbie; so any help will be greatly
appreciated. Thank you for all the info.

1. Save the username/password in your browser and use the form-filling
feature to do the login.

2. If you need a Javascript solution, use user javascript to fill the
form fields and do the submission as per the web page code. This will
ensure that site's javascript gets to hashing the submitted contents.

3. If the website allows authentication without javascript, then what
Jorge suggested would work.
http://example.com/login.html?user=user&password=password
Of course, you need to look at the source, identify the form fields and
then construct the correct URL with hidden additional fields if present
or required. They may however block GET method in authentication.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Members online

Forum statistics

Threads
473,770
Messages
2,569,585
Members
45,080
Latest member
mikkipirss

Latest Threads

Top