Search code examples
asp.netquery-stringmembership

ASP.NET Forms Authentication via Querystring

I currently have an ASP.NET 3.5 SP1 running on IIS 7. I have enabled forms authentication using .NET Membership and setup some folders that are restricted according to roles I have created. For instance, if an anonymous visitor tries to access the file http://www.example.com/restricted/foo.txt, he/she will be redirected to a login page, as expected. So far so good.

What I would like to do is provide access to protected files by allowing visitors to specify their login credentials in a query string, something alone the lines of:

http://www.example.com/foo.txt?user=username&pass=pwd

Is this possible at all?

Solution

  • you should be able to write an http module that intercepts the request and authenticates the user based on the querystring. However, just for the sake of completeness, I'd like to question whether it's a good idea to provide users their username and (in particular) password in plaintext.