|
-Ron
Our login page will be SSL encrypted. What
I am trying to avoid is passing the information in an unsequre form from page
to page.
----- Original Message -----
Sent: Tuesday, August 08, 2000 12:35
PM
Subject: RE: [IMail Forum] Login
It would
put them in hidden fields on the html form, so that user (only) could see
them with a View Source. Passing them to the login form is no less secure
than any other html post with the username and password. So, in effect, the
method is no less secure than a standard, non-SSL login form... for anyone
else to get the username and password, they'd need to be sniffing the
packets. And that's doable even with regular password
fields.
-Ron
I'm not sure that this would be acceptable
because we have some imposed security requirements. Wouldn't this
put the UserName and Password in plain text for anyone to see. Any
more thoughts would be appreciated.
----- Original Message -----
Sent: Tuesday, August 08, 2000
11:41 AM
Subject: RE: [IMail Forum]
Login
Mike,
Someone asked that question here yesterday.
Here was my answer:
Check out our sample form code
at http://hksi.net/imail-login.htm.
To make it "automatic", change the
userid and passwd fields to
type="hidden", then fill their values with ASP code, probably
something like
value="<%=UserName%>" and value="<%=Password%>". Then, all
the user has to do is click the
Submit button (or a link that triggers a
JavaScript form submission), and they'll be logged right
in.
Also,
there is no API into the heart of IMail. But we can still dream...
:)
Hope this helps,
Ron
ron
allen hornbaker humankind systems,
inc. mailto:[EMAIL PROTECTED]
HKSI WebMail Templates for IMail v6x ~
Now 607 Installations
Worldwide
Demo: http://mail.hksi.net Buy: http://humankindsystems.com/products
We are evaluating whether to purchase the
IMail package. We have a need for a common login area that
provides access to several resources. Email is one of
them.
We want the user to be able to login once
and have access to any of the resources without having to login
again.(The resources will be on different servers).
After a quick tour of the product I was
not able to find any exposure of the API other than through the tags
and templates. Is there an interface that can be accessed
programatically. Or is there another way to credential a user
outside the provided Login.cgi, and have that information forwarded to
the mail system for authentication.
Any help provided will be greatly
appreciated.
Thanks,
Mike
Kowalski
|
