Re: Passing custom headers to login page

several ways... and there are always more. since client sites are calling
into this you can't use a cookie.

1. use third party software to do authentication between both
2. use querystring encryption - I have a class you could use for this rather
than passing plaintext. it helps but by no means considered 'secure'
3. write a slightly better system - you could try something where the client
server makes a request to your website and is granted a temporary token(s).
they then redirect to your site with that token.. only valid for say...... 2
minutes.
user information is stored on your end.  when a session requests to start on
your website, check for that token(s) passed in. details are retrieved from
 db and user is authenticated via code. of course encrypt information
everywhere.
this is better than querystring. querystring retains in user's history.






On Fri, Oct 10, 2008 at 10:01 AM, Mont Rothstein
<[email protected]>wrote:

> Adam, thanks, you have been a huge help.
> The FormsAuthentication methods were what I was missing.
>
> Re-writing the response to be an auto-submitting page didn't work because
> ASP.NET <http://asp.net/> was po'd that the view state wasn't there.
>
> My custom header idea seems to be a no-go because there is no way to add
> custom headers to a re-directed response.
>
> That seems to leave me with having to pass the username and password in the
> query string.
>
> Do you see any other option (other than not doing this cross-site autologin
> at all :-) ?
>
> Thanks again,
>  -Mont
>
> ===================================
> View archives and manage your subscription(s) at
> http://peach.ease.lsoft.com/archives
>

===================================
View archives and manage your subscription(s) at http://peach.ease.lsoft.com/archives