dotnet security: Propagate Credentials from Internet Explorer Host Instead of Defau -- dotnet security

Re: Propagate Credentials from Internet Explorer Host Instead of D

Markus
7/28/2005 7:26:01 AM

Hi Nicole,

thanks for you're fast reply.

I understand you're issue but:

- The control is fully trusted (!)
- The control can propagate the credentials the ie process has been opened
with (the network logon)

So why can't it propagate those credentials the site it is hosted by has
been access with?

Is there a WIN 32 API allowing this behaviour?
Is this possible with COM/ATL/ActiveX?

Thanks for you're help

[quoted text, click to view]

Re: Propagate Credentials from Internet Explorer Host Instead of Defau

Nicole Calinoiu
7/28/2005 10:06:59 AM

No, it's not possible. If it were, it would represent a security hole in IE
since hosted controls (.NET, ActiveX, applet, etc.) would be able to
potentially misuse those credentials, for example in traffic redirected at
other sites.

[quoted text, click to view]

Re: Propagate Credentials from Internet Explorer Host Instead of D

Nicole Calinoiu
7/28/2005 10:46:28 AM

[quoted text, click to view]

Even unmanaged code does not have access to this informaiton.

[quoted text, click to view]

Those are the credentials under which the control is running, not
credentials cached under another process (IE). In addition, the control
doesn't actually have direct access to the credentials themselves. Don't
forget that the target site may use basic authentication, in which case the
user name and password will both be exposed.

[quoted text, click to view]

Presumably because Microsoft has deemed the risk to be too great.

[quoted text, click to view]

AFAIK, IE does not allow this information to be divulged to any hosted
control, regardless of the technologies used to build it. You might want to
try an IE programming group if you want to confirm this.

That said, there are other ways to work around the problem. See
http://groups-beta.google.com/group/microsoft.public.dotnet.security/browse_frm/thread/21ffb3fbbe4b1aa4/3805e0f0a2e45d7c
for some options.

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages in the dotnet security group.