Best way to auto login in web application

Question

This question could be titled "Place password hash and salt in query string?" as well to be less subjective, but the point remains the same:

I want to create kind of a launcher application for my web application, which should allow the user to specify his credentials to auto login into my web application.

Now since plaintext is almost always awful, I thought about passing the password hash and salt as a querystring to my application to perform an auto login. Something like: http://myapp.com/login/?autologin=true&passwordhash=foo&salt=bar

But I wonder if there is any better or more secure way instead of doing this?

Answer 1

Just do a HTTPS POST in your launcher application, passing through the username+password normally. That's how your web browser does it.

Answer 2

Don't send even hashed passwords in plaintext and especially not in the URL. A time-limited token is much less valuable to an attacker.

Use a cryptographically secure random generator to create a unique token for each user. You'll need to work out how to issue new tokens when the old ones expire. This is how most email-login links work.

Answer 3

Even hashing the password and sending it via GET or POST is a serious breach if you only send it via HTTP - anyone can intercept the plaintext request and use that hashed value to access from anywhere else as that user.

If you're going to do this kind of thing, you absolutely should be using HTTPS - with a proper certificate from a recognised authority. That way, the information is encrypted and much harder to intercept (SSL can still be decrypted by third parties, but a decent key length and configuration should make this a very expensive operation).