Encode username and password in URL

Question

Hi all, is it possible to encrypt the username and the password in an URL, like no one can directly read it? We don't want to use anonymous users anymore. Neither send the password in plain writing in the url like in... /dashboard.action?os_username=&os_password= Source: Confluence URL list Thanks!

Shannon S · Answer

Hi Manuel,

Thank you for explaining a bit more about your requirements.

Confluence doesn't send the username and password via the URL, but the page headers. If when you are sending as variables, then it will be encrypted when you use https.

The best solution would be to make sure that each of your users has their own Confluence license. You can create separate groups in Confluence so that some of your users can only read and not edit.

Otherwise you would need to develop something in-house. Have a look at our Developer Resources for help on that. We also have a Developer Community, much like this one, where they can help you with any issues you're having with this type of customization.

Regards,

Shannon

Manuel_ygqka1 · Answer

Hi Shannon,

Thank you for your reply.

We use Confluence internally as a WIKI. Some staff members use confluence to look up information they need for production. Since they do not produce content they currently use anonymous access. We want to disable anonymous access now, so we want them to use one shared user. To provide the login credentials we thought about a link with a "complecated hash code" (or the like) which we can store on the browsers on the PCs at the shopfloor. Just to make it difficult to get this credentials and change the password silently from time to time. Just like when you share a link to a shared folder in the cloud. Do you have any suggestion?

Thanks!

Regards, Manuel

Shannon S · Answer

Hello Manuel,

Thank you for contacting us about this. We have plans to remove support for this completely in 2020, so I don't recommend using this method. There is not a way to encode this in the URL, either.

Here's the request we will work on to remove the functionality:

* CONFSERVER-33816 Remove support for os_username, os_password and os_cookie

There's likely a better way to accomplish what you need to do. Can you tell us exactly what you're trying to do so we can come up with a better solution for you?

Regards,

Shannon