如何在URL中添加登录凭证？验证HTTPS参数传递可行性

Hey there! Let's break down your question and walk through the solutions step by step.

First off, the format you tried (https://myserver.com/~username=username&password=mypassword) isn't the standard way to handle HTTP authentication. Here's what you need to know:

1. Standard HTTP Basic Authentication URL Format #

The RFC-compliant method to include credentials directly in a URL places them before the domain name, using this structure:

https://username:password@yourdomain.com/path/to/resource

For your target document link, that would translate to:

https://your_username:your_password@www.globalnorm.net/gn/doc.php?name=ASTM%20F%202638:2012-00&erx=0

Critical Notes for This Method: #

• Always use HTTPS: If you use unencrypted HTTP, your username and password will be sent in plain text—this is extremely risky. Modern browsers also block this authentication method over HTTP for security reasons.
• Browser restrictions: Some browsers (like Chrome) may block this URL format and prompt you to enter credentials manually instead. This is a safety measure to prevent accidental credential exposure if the link gets shared.
• Site compatibility: Not all websites support this method. Many platforms disable URL-based authentication to avoid leaks from shared links or logged URLs.

2. If Basic Authentication Fails #

If the standard URL format doesn't work, the site likely uses form-based authentication (via POST/GET parameters to a dedicated login endpoint). Here's how to troubleshoot:

• Use your browser's Developer Tools (Network tab) to watch the login request when you sign in manually. Look for the POST request sent to the login page, and note the parameter names (they might be username/password, or custom labels like user_id/pass_code).
• To access the target document, you'll need to:
  1. Send a login request with your credentials (usually via POST) to get a session cookie.
  2. Include that cookie in your subsequent request to the document URL.

For example, using curl this would look like:

# Log in and save the session cookie to a file
curl -c cookies.txt -d "username=your_username&password=your_password" https://www.globalnorm.net/login

# Access the document using the saved session cookie
curl -b cookies.txt https://www.globalnorm.net/gn/doc.php?name=ASTM%20F%202638:2012-00&erx=0

3. Key Security Reminders #

• Never transmit credentials over unencrypted HTTP—always confirm the site uses HTTPS.
• Avoid sharing URLs that include credentials: even over HTTPS, the password is visible in the URL bar and browser history.
• If you're building an application, consider more secure methods like OAuth or API keys instead of URL-based credentials.

内容的提问来源于stack exchange，提问作者MokiNex