Question regarding bypassing security

[tim almond]

I currently have a system where the client has a login page which has a
SQL server database behind it and does authentication.

The client wants to have a page which can be logged into by passing a
user ID/password into the URL. I also need the system to say that if
there is no user ID/password, it needs to check the session status.

The best approach I can think of is to drop any role requirements off
this page but when the page load, manually do a check on the login
credentials passed in the URL against the database and if OK (or if
there is already a session), create a session and continue.

Any other cleverer ideas than that?

Thanks in advance.

[Robbe Morris [C# MVP]]

That is a HUGE security risk. So much so that microsoft.com
won't let you authenticate to windows like that anymore.

--
2005 Microsoft MVP C#
Robbe Morris
http://www.robbemorris.com
http://www.masterado.net/home/listings.aspx

"tim almond" <vv@iijjhh> wrote in message
news:OW**************@TK2MSFTNGP15.phx.gbl...

I currently have a system where the client has a login page which has a SQL
server database behind it and does authentication.

The client wants to have a page which can be logged into by passing a user
ID/password into the URL. I also need the system to say that if there is
no user ID/password, it needs to check the session status.

The best approach I can think of is to drop any role requirements off this
page but when the page load, manually do a check on the login credentials
passed in the URL against the database and if OK (or if there is already a
session), create a session and continue.

Any other cleverer ideas than that?

Thanks in advance.