实现自动登录第三方网站

Question

My node-based web service links to a external 3rd party site that requires a username/password which we also have (but not the same as the login ofr our webservice). To provide a seamless user experience, when the user clicks the link to the 3rd party site, I would like to automatically log them in with the username/password, and take them straight to the external page's dashboard.

At the very least, I would like to pre-populate the 3rd party login form with this information, but this post detailing a similar situation doesn't make me optimistic.

I do not believe the 3rd party site supports OAuth or existing SSO protocols. I cannot use an iFrame. One viable option seems to be using some kind of proxy , or using requests (or tokens?) to the 3rd party site.

Knowing that I have no control over the 3rd party login, what are some high-level options for how to accomplish this end goal? What are some things I need to be wary of when choosing a solution?

Answer 1

The short answer is that you cannot accomplish this if the foreign site uses CSRF protection on the form, or doesn't allow querystring parameters for form inputs.

Here's what you can try:

• Try redirecting the user to https://website.com/login?username=xxx&password=xxx
• If that works, you're good to go. If not, there's likely not a way to make this work in browser.

Inspect the source code of the login page, and use the HTML input name tag values in your querystring for the redirect. So if the form has username and password input fields, you'd use those two names.

Now -- please keep in mind that what you're attempting to do is generally NOT a good idea.

Storing a user's credentials for another website is a HUGE security risk, and really not a good idea. If the site / service doesn't offer SSO / Oauth, this is likely going to be a problem for you in the future.

Among other things, here are some of the bad things that can happen:

• Someone gets a hold of the domain and captures all requests with the username/password.
• The user's computer has been hijacked or man-in-the-middled such that when you redirect the user to this website, a third party captures the username/password info.
• The website changes their login form, and you end up sending credentials to another place on accident.
• The website logs their incoming GET requests, and now has a bunch of credentials stored in plain text on their web servers (if these logs get out, that's bad).