"Bob Barrows [MVP]" wrote:

> Me wrote:
> > I am passing the userid and password from one asp page to another,
> > how can I restrict it from displaying it on the url?
> >
> > Eg. http://mywebsite/employeeinformation.asp?variable=myname
> >
> > I would like it to show just
> > http://mywebsite or at the most
> > http://mywebsite/employeeinformation.asp.
> >
> Simple. don't pass sensitive information in the URL. Use the Session
> object to preserve this information - no need to pass it from page to
> page.
>
>
> --
> Microsoft MVP -- ASP/ASP.NET
> Please reply to the newsgroup. The email account listed in my From
> header is my spam trap, so I don't check it very often. You will get a
> quicker response by posting to the newsgroup.
>
>
>

"Me" <M*@discussions.microsoft.com> wrote in message
news:43EB1F21-D42D-4A3C-87B0-CA46EE128BD0@microsoft.com...
> I am passing the userid and password from one asp page to another,
> how can I restrict it from displaying it on the url?
>
> Eg. http://mywebsite/employeeinformation.asp?variable=myname
>
> I would like it to show just
> http://mywebsite or at the most http://mywebsite/employeeinformation.asp.
>
> Thank you,
> -Me
>

"Steven Burn" wrote:

> Stick it in a session var?, a DB?
>
> --
> Regards
>
> Steven Burn
> Ur I.T. Mate Group
> www.it-mate.co.uk
>
> Keeping it FREE!
>
> "Me" <M*@discussions.microsoft.com> wrote in message
> news:43EB1F21-D42D-4A3C-87B0-CA46EE128BD0@microsoft.com...
> > I am passing the userid and password from one asp page to another,
> > how can I restrict it from displaying it on the url?
> >
> > Eg. http://mywebsite/employeeinformation.asp?variable=myname
> >
> > I would like it to show just
> > http://mywebsite or at the most http://mywebsite/employeeinformation.asp.
> >
> > Thank you,
> > -Me
> >
>
>
>

"Dave Anderson" wrote:

> Me wrote:
> > I am passing the userid and password from one asp page to
> > another, how can I restrict it from displaying it on the
> > url?
> >
> > Eg. http://mywebsite/employeeinformation.asp?variable=myname
>
> If you do not want credentials in the querystring, do not put them there.
>
> That leaves the rest of the request, including headers. None of these is an
> especially great parking place for credentials unless you are using SSL.
>
> The *simplest* solution is probably to use integrated Windows security.
> Alternately, you could store credentials in session variables. Your question
> is far to general to merit further comment.
>
>
>
>
> --
> Dave Anderson
>
> Unsolicited commercial email will be read at a cost of $500 per message. Use
> of this email address implies consent to these terms.
>
>
>