Auto authenticate a htaccess (401) username password login

Question

I have a webpage which refreshes every 5 minutes with client details. I have added a username password to it through the basic and standard htaccess and a htpassword file type login system it since part of the file contains company data.

But I need this same webpage to be opened at my work PC which is a secured PC connected to a display screen to display same.

On a power cut or a internet disconnection the PC has a startup file with a shortcut to this webpage so it appears automatically BUT stops from the 401 Authorization login form. So no go until I fill the details.

Is there a way I can keep a file with a php or a javascript or jquery code so it can feed the username password to that and open the webpage (even as a iframe)?

No need to worry about the safety of the file - the PC is locked in a cabinet with only a small set of holes for ventilation and for the display cable coming out to the monitor and another small hole to reach the power button.

If you know to do this on android let me know as well.

Found the answer!! See my post below!

Answer 1

UPDATE: This answer may no longer work in newer browsers.

Because phishing people use @ and : marks in URL to hide URLs. For example in a URL like www.facebook.com:somelongtext@www.notfacebook.com user will oversee @notfacebook.com part and enter login details to a phishing webpage without noticing the latter. So now either this method will not simply work or either you will see a warning saying this URL maybe a phishing site. So even if it's a private webpage where only you have access to it browser will try its protective mechanisms.

Found the answer!

Can pass it from the URL itself!

http://username:password@www.yourdomain.com

and the content of the url gets hidden after as well Also global compatible as I know!

Answer 2

1. Ditch htaccess/htpasswd
   It's OK for the most basic scenarios, but once you need to go beyond it [ie: your position right now] HTTP auth become a horrible pain in the ass.

2. Use forms-based authentication
   It takes a little work, but this is probably one of the few things that every single PHP dev should know by heart.

3. Whitelist your IP range, and use an access token
   You say you can't simply whitelist the IP because it's on DHCP, and that's fine. Find the range that your DHCP server is allocating [eg: 1.2.3.0/24] and configure your forms auth to allow unauthenticated requests when accompanied by a pre-set token.

   eg: requests from 1.2.3.4 are permitted when token is set to d8e8fca2dc0f896fd7cb4cb0031ba249 like:
   http://yourdomain.com/dir/script.php?token=d8e8fca2dc0f896fd7cb4cb0031ba249