Can you pass user/pass for HTTP Basic Authentication in URL parameters?

Solution 1:

It is indeed not possible to pass the username and password via query parameters in standard HTTP auth. Instead, you use a special URL format, like this: http://username:[email protected]/ -- this sends the credentials in the standard HTTP "Authorization" header.

It's possible that whoever you were speaking to was thinking of a custom module or code that looked at the query parameters and verified the credentials. This isn't standard HTTP auth, though, it's an application-specific thing.

Solution 2:

http://username:[email protected] will works for FireFox, Chrome, Safari BUT not for IE.

Microsoft Knowledge Base

---

Solution 3:

Passing Basic authentication parameters in URL not recommended

There is an Authorization header field for this purpose check it here: http header list

How to use it is written here: Basic access authentication

There you can also read that although it is still supported by some browsers the suggested solution of adding the Basic authorization credentials in the url is not recommended.

Read also chapter 4.1 in RFC 2617 - HTTP Authentication for more details on why NOT to use Basic Authentication.

---

Passing authentication parameters in query string

When using OAuth or other authentication services you can often also send your access token in a query string instead of in an authorization header, so something like:

GET https://www.example.com/api/v1/users/1?access_token=1234567890abcdefghijklmnopqrstuvwxyzABCD