Basic authentication and KB832894

[tito]

Hi,

After applying "Cumulative Security Update for Internet Explorer
(832894)":

http://www.microsoft.com/technet/tre...n/ms04-004.asp

i am no longer able to authenticate users using this type of url:

https://un:pa**@www.blahblah.xyz

Reason for specifying un and pass in url is to stop transmitting
basic authentication in clear text but through https.
Code looks like:

<?
if ($HTTP_SERVER_VARS['HTTPS'] != 'on'){die("You must use HTTPS!");}

$un = $HTTP_POST_VARS['un'];
$pass = $HTTP_POST_VARS['pass'];
print ( "<META HTTP-EQUIV=\"Refresh\" CONTENT=\"0; URL=https://" .$un.
":" .$pass. "@www.blahblah.xyz/~" .$un. "/page.php\">");
?>

How can I do this in a different way?

Thanks in advance.
Tito

[Cameron]

tito wrote:

Hi,

After applying "Cumulative Security Update for Internet Explorer
(832894)":

http://www.microsoft.com/technet/tre...n/ms04-004.asp

i am no longer able to authenticate users using this type of url:

https://un:pa**@www.blahblah.xyz

Reason for specifying un and pass in url is to stop transmitting
basic authentication in clear text but through https.
Code looks like:

<?
if ($HTTP_SERVER_VARS['HTTPS'] != 'on'){die("You must use HTTPS!");}

$un = $HTTP_POST_VARS['un'];
$pass = $HTTP_POST_VARS['pass'];
print ( "<META HTTP-EQUIV=\"Refresh\" CONTENT=\"0; URL=https://" .$un.
":" .$pass. "@www.blahblah.xyz/~" .$un. "/page.php\">");
?>

How can I do this in a different way?

Thanks in advance.
Tito

Errr, I'm no expert on https but I was under the impression that
everything that goes to the web server using the https protocol is
encrypted, it's not just for the username and password.

~Cameron

[AJ Z]

On 2004-02-03 04:02:47 -0800, Cameron <fo*@bar.invalid> said:

You are correct. If SSL is being used for the connection then the
username/password is not transmitted in the clear, even with the prompt.
Entering your URL in that manner will only tell IE to use that info instead
of prompting for it.

--
AJ Zmudosky
There are no stupid questions, but there are a LOT of inquisitive idiots.

[tito]

That's true.
But if client request page through HTTP he is prompted for un and pass
and it
goes in clear text. I am not in situation to change apache
configuration file to rewrite HTTP to HTTPS.