Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

This question could be titled "Place password hash and salt in query string?" as well to be less subjective, but the point remains the same:

I want to create kind of a launcher application for my web application, which should allow the user to specify his credentials to auto login into my web application.

Now since plaintext is almost always awful, I thought about passing the password hash and salt as a querystring to my application to perform an auto login. Something like: http://myapp.com/login/?autologin=true&passwordhash=foo&salt=bar

But I wonder if there is any better or more secure way instead of doing this?

share|improve this question

3 Answers 3

up vote 3 down vote accepted

Just do a HTTPS POST in your launcher application, passing through the username+password normally. That's how your web browser does it.

share|improve this answer
    
Absolutely. If you can use HTTPS to avoid plaintext altogether, you should do that. –  ajlane May 10 '13 at 0:09

Don't send even hashed passwords in plaintext and especially not in the URL. A time-limited token is much less valuable to an attacker.

Use a cryptographically secure random generator to create a unique token for each user. You'll need to work out how to issue new tokens when the old ones expire. This is how most email-login links work.

share|improve this answer

Even hashing the password and sending it via GET or POST is a serious breach if you only send it via HTTP - anyone can intercept the plaintext request and use that hashed value to access from anywhere else as that user.

If you're going to do this kind of thing, you absolutely should be using HTTPS - with a proper certificate from a recognised authority. That way, the information is encrypted and much harder to intercept (SSL can still be decrypted by third parties, but a decent key length and configuration should make this a very expensive operation).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.