Authenticating to a Web Site WITHOUT the user/password popup

[Nobody]

This problem has been challenging me for several days now.

I have a web site that uses the usual, mundane Basic Authentication.
But, now I have a request (actually, a demand) that users from a
particular, trusted subnet of my company, want to be able to have
access to the web site WITHOUT the username/password popup window
coming up. (They don't even want to type it in once and check "Keep
this Password"!) This is not a homegrown website, so I have little
or no control about the authentication process from that end.

However, I do have a plan:

I want to point those users (in that subnet) to a "phony" page. That
page would have PHP coding that would check their incoming IP address,
and, if they fall within the proper range, would GIVE them the realm,
username and password (and even the base64 encoded Authentication
string!) that they should use to request the actual page. What I
can't seem to figure out is how to set those credentials using a
client-side script like JavaScript within the browser and then force
an HTTP request of the "real" page, this time using the given
authentication and avoiding the popup login window.

Does anyone know how to do this? Or, even, is what I am trying to do
possible? Any comment and suggestions would be greatly appreciated.

Thanks,
Tom
to**@cohesion.com

[Colin McKinnon]

Nobody spilled the following:

This problem has been challenging me for several days now.

I have a web site that uses the usual, mundane Basic Authentication.
But, now I have a request (actually, a demand) that users from a
particular, trusted subnet of my company, want to be able to have
access to the web site WITHOUT the username/password popup window
coming up. (They don't even want to type it in once and check "Keep
this Password"!) This is not a homegrown website, so I have little
or no control about the authentication process from that end.

However, I do have a plan:

I can't say whether your plan would work, but given its objectives, it could
only be acheivable by undermining the security model built into javascript
and http. Even if it did work, the solution is likely to be limited by the
version of browser.

The problem also seems to involve a third party whose security model you are
trying to subvert - presumably without their knowledge/co-operation.

It is possible to solve the problem in a technically 'correct' manner, but
not using javascript. But that still doesn't resolve the ethical issues.

I would suggest that you begin by looking to re-implement the authentication
system with the cooperation of the website owners/developers, and only if
you've exhausted that avenue, go click on the 'Keep this password'
yourself.

C.

[nowhere]

On Thu, 18 Nov 2004 22:38:02 GMT, Colin McKinnon
<co**********************@ntlworld.deletemeunlessU RaBot.com> wrote:

Nobody spilled the following:

This problem has been challenging me for several days now.

I have a web site that uses the usual, mundane Basic Authentication.
But, now I have a request (actually, a demand) that users from a
particular, trusted subnet of my company, want to be able to have
access to the web site WITHOUT the username/password popup window
coming up. (They don't even want to type it in once and check "Keep
this Password"!) This is not a homegrown website, so I have little
or no control about the authentication process from that end.

However, I do have a plan:

I can't say whether your plan would work, but given its objectives, it could
only be acheivable by undermining the security model built into javascript
and http. Even if it did work, the solution is likely to be limited by the
version of browser.

The problem also seems to involve a third party whose security model you are
trying to subvert - presumably without their knowledge/co-operation.

It is possible to solve the problem in a technically 'correct' manner, but
not using javascript. But that still doesn't resolve the ethical issues.

I would suggest that you begin by looking to re-implement the authentication
system with the cooperation of the website owners/developers, and only if
you've exhausted that avenue, go click on the 'Keep this password'
yourself.

C.

Just to clarify, we OWN the website, and have full control over the
usernames, passwords, etc., it's just that it is a purchased software
package that necessitates authentication via the Basic model. I speak
with the software company fairly regularly and they couldn't care less
about who we let access it and how, especially since we (once again)
own this copy of the software. So, that should allay any fears over
the ethics of what I am trying to do.

What I would like to see is if anyone has a reasonable solution to
this problem that they might want to share, or at least direct me to
where I might begin to solve it on my own. If JavaScript is not the
answer, might anything else be?

Thanks, in advance, again,
Tom

[Robert]

Colin McKinnon <co**********************@ntlworld.deletemeunlessU RaBot.com> wrote in message news:<ev**************@newsfe5-win.ntli.net>...

I have a web site that uses the usual, mundane Basic Authentication.
But, now I have a request (actually, a demand) that users from a
particular, trusted subnet of my company, want to be able to have
access to the web site WITHOUT the username/password popup window
coming up. (They don't even want to type it in once and check "Keep
this Password"!) This is not a homegrown website, so I have little
or no control about the authentication process from that end.

Here is what I would try:

1) trace the TCP/IP data traffic on a client to see what is being sent
to the server as the logon.

2) Make a bookmark of this data

3) Try the bookmark and see if it works

4) If the bookmark works, create a web page that automatically submits
the logon
Another idea would be to try a commercial product like:

Password Officer
- fully handles logon to web-pages
- fills in the URL, forms, clicks to buttons
- detects and fills in any program window
etc.

http://www.compelson.com/pofi.htm

Robert