URL Authentication - IE Silliness - The HP Security Laboratory Blog -
URL Authentication - IE Silliness

IE dropped support for URL authentication (e.g., http://user:pass@example.com/) around 2004. There are plenty of discussions out there about the merits and problems with URL authentication, so I won't comment on it yet again. However, it is still in the RFC.

If you try to load a URL with authentication in IE 6, you see the message "Invalid Syntax Error: Page Cannot Be Displayed" -- which at least points to the fact that there may be a problem with the link you followed. However, I happened to notice in IE 7 that they've dumbed it down a little further: "Windows cannot find 'http://user:pass@example.com/'. Check the spelling and try again"

If you don't put the "http://" in your browser (because for years browsers have been teaching people not to type the protocol), you get the completely different error "The webpage cannot be displayed."  

Way to go IE team! Rather than providing a better user experience, you hint that the site name is incorrect and leave it alone. Good job helping to educate your users.

Incidentally, Firefox, Safari and Opera will ignore invalid syntaxes like http://@example.com/ so you could create links that exclude IE users, should you be into that sort of thing for fun or profit.


Posted 12-08-2008 5:53 PM by Chris Sullo

Add a Comment

(required)  
(optional)
(required)  
Remember Me?

Type the numbers and letters above: