Login problems after latest IE security patch

[graziano]

I was using following simple script to permit my users to login inside neomail

if ($main ==1) {
echo "<meta http-equiv=\"REFRESH\" content=0;URL=http://$domain:2095/$user/neomail.pl>";
}
else
{
echo "<meta http-equiv=\"REFRESH\" content=0;URL=http://$domain:2095/$user+$domain/neomail.pl>";
}

now , it's not more possible ,infact latest IE security patch prevents IE users from using
http://USERNAME😛[e-mail]

Is there any solution to permit my users to login without prompt ?

Thanks

[LordShryku]

Unfortunately, not using that method with IE. That's normally reservered for an htaccess login, and with MS's hatred for when things actually work right, they've disabled it. You could go about making another kind of login using custom sessions/cookies.

[Weedpacket]

Originally posted by LordShryku
... and with MS's hatred for when things actually work right, they've disabled it.

I reckon MS actually got this one right; you have to admit it's pretty braindead to have your password in clear in a URL.

RFC2396
Some URL schemes use the format "user:password" in the userinfo field. This practice is NOT RECOMMENDED, because the passing of authentication information in clear text (such as URI) has proven to be a security risk in almost every case where it has been used.

[LordShryku]

Not to say that I ever use this format, but it's been used for a very long time. But I think it's up to the webmaster to make the decision himself to use this or not.

This practice is NOT RECOMMENDED

That's kinda out the window now with IE, because it just won't work anymore.

[bad76]

Hi,
what about header?

Some header like:
header('WWW-Authenticate: Basic realm="neomail" user="$username" password="$pass"');

You can find some info here:
http://www.ietf.org/rfc/rfc2617.txt

Good luck...

[graziano]

Thank you Bad