usr and password in URL

[EZRhino]

Can anyone tell me how to keep my server from allowing the user name password to used in the url?
Example http://user:[email protected]/members
Password sites use this alot.

[Babaganoosh]

That's not possible as far as I know. You might want to check into something like Pennywize http://www.pennywize.com/

[Sonny]

a quick fix for not showing the user name and pass on the url is to use frames..

with frames, the passing argument doesnt show up.

[glipglop]

If your website is on a Windows server, you could use Titan from Flicks Software.


http://www.flicks.com/prod.htm#titan


It will allow you to deny any URL request to your server with an @ sign in it. Also good for stopping buffer overflow attempts.

[fucktard]

The only advice I could offer is forcing logins and all transactions via HTTP form POSTs and storing info in session variables and reading from that.