INFO: URL Syntax for Authentication Without Dialog Prompt

MORE INFORMATION

Even though this syntax is actually part of the URL specification for the FTP protocol (not HTTP), it was common practice to support the syntax for HTTP requests with browsers even before the release of Internet Explorer 3.0 .

The Win32 Internet API (WinInet) function InternetOpenUrl also accepts HTTP URLs of this form. However, the other WinInet APIs, such as HttpOpenRequest, require that the program parse the URL and make the calls necessary for authentication. For more information, please refer to the "HTTP Authentication" (HTTPAUTH) sample on the MSDN Online Workshop at: NOTE: Please be aware that the use of this URL syntax has potential security implications, as it exposes the user's name and password in plain text within the URL for the displayed page.

An example of the security danger is that in a cross-frame or hidden-frame scenario, script in pages from visited Web sites can easily access the URL, parse it, and determine the username and password for other sites.

NOTE: The following IE 3.02 security patches are known to break this syntax.

• Page Redirect Patch - November, 1997
• Year 2000 Update - May, 1998

If use of this syntax is required in addition to the fixes listed above, then the only currently supported resolution is to upgrade to Internet Explorer 4 or 5.