Apache Cookbook, 2nd Edition

6.17. Accessing Credentials Embedded in URLs

Problem

You know people access your site using URLs with embedded credentials, such as http://user:password@host/, and you want to extract them from the URL for validation or other purposes.

Solution

None; this is a nonissue that is often misunderstood.

Discussion

Embedding the username and password in the URL gives a way to distribute a link to your users to access a password-protected site directly without being prompted for the password. However, what tends to be misunderstood about this is that the username and password are actually sent to the server in the ordinary way (i.e., via the WWW-Authenticate header) and not as part of the URL. The browser dissects the URL and turns it into the appropriate request header fields to send to the server.

See Also

• The HTTP, Browsers, and Credentials sidebar, earlier in this chapter