Hiding passwords embedded in URLs

Can it be done with a POST?

[david752]

I am creating a Web site. In it I want to allow the user to browse to their email page. The email system is supported by my hosting service, so I must use it as-is.

The problem is that the email page requires the URL to have the user's password embedded in it.

This is what the URL looks like:

[username:password@server:2095...]

If my page constructs and browses to such a URL, it will be visible in the window title bar, and also in the History object. This is clearly not secure.

I have tried writing a page that contains a form that does a POST to a PHP page that constructs the URL and then uses the PHP function readfile to send the URL. But this works only for the first page, because the PHP model is to construct a browser page, not to pass the browser through to the URL. As soon as the user tries to read or compose email, the browser reports Page Not Found.

It seems to me that there must be a way to support bookmarking a page frameset configuration. Does anyone have an idea?

David

[knightyme]

A programmer at ScriptMasters [scriptmasters.biz] recently completed a project that is, at least very similar to what you are describing. If all else fails, you could always try posting it there and see if the original author bites.

Good luck.