Re: Passing custom headers to login page

I hope you are using https for this otherwise they will easily be sniffable.
the headers should be encrypted, so use ssl if you aren't.


if you are adding a response header and then redirecting.. you are trashing
those headers because the browser is just going to process the redirect and
thats it.
you would need to form the request from the client.
you could write the values to a page, and the page itself posts the login
info to the new site (using ssl of course).




On Thu, Oct 9, 2008 at 11:57 AM, Mont Rothstein <[email protected]>wrote:

> I am working on the ability for a site (A) to open another site (B) and
> automatically log the user in.
> The two sites will not be on the same server.
>
> I am using Forms based authentication.
>
> I have this working with query strings.  I grab the user name and password
> from the URL, decode them, put them in hidden fields, and then use
> Javascript to populate the fields and click the login button.
>
> I'd rather not use the query string parameters to pass the user name and
> password.  I'd prefer to pass the values in custom headers but I can't get
> that to work.
>
> I've used Response.AddHeader() in site A both before and after my call to
> Response.Redirect() but no matter what I do my custom headers are not in
> the
> Request.Headers in site B.
>
> My code looks something like:
>
>        protected void Open_Click(object sender, EventArgs e)
>        {
>            Response.AddHeader("Test","MyTest");
>            Response.Redirect("http://localhost:4723/SiteB/Login.aspx);
>        }
>
> This is a call directly to the Login.aspx page so it has not been
> re-directed from another page for authentication (which would cause the
> headers to be lost).
>
> Does anyone know how I can do this?
>
> Thanks,
> -Mont
>
> ===================================
> View archives and manage your subscription(s) at
> http://peach.ease.lsoft.com/archives
>

===================================
View archives and manage your subscription(s) at http://peach.ease.lsoft.com/archives