We have a form that users need to fill out, but it is accessible only to authenticated users. We want to send a mass email to all users with an username and a password embedded in an URL, so that users can just click on that URL and log in to Drupal. The username and password will be common for all users.

Is it possible to log in to Drupal through this way?

  • Hello Ajinkya Kulkarni, and welcome on Drupal Answers. For which Drupal version are you interested? It is important to know that because, basing on that, the answer would change.
    – apaderno
    Mar 29, 2011 at 17:47
  • Sorry that I did not mention it before. I am interested in Drupal 6. Mar 29, 2011 at 18:40

4 Answers 4


Clearly there are too many good options.

There is also http://drupal.org/project/tokenauth. This would allow you to craft a link for email that would auto-login the user for whichever pages you configured to be accessible via token.

Some details from the module's project page:

Token Authentication provides a token for use in the URL to authenticate users to your site. It only works on paths configured in the settings page.

Originally this module was intended to offer simple authentication for RSS feeds to allow feed readers to pull customized content listings. You can now use it to provide a simple browsing experience of any Drupal content.

Be careful with what paths you expose to Token Authentication, as it is effectively a very simple, very low security password mechanism. You can expose Administration pages through bad configuration.

  • Thanks, this module did the job. But, when user goes to a form with url like myportal/node/add/myform?token=rbkrIlw9GX and submits a form, Drupal takes user to myportal/node/[node_id] after form is submitted, which then displays a 'Access Denied' message. So user might get confused whether form is submitted or not. I solved that problem by adding a message box on 'Submit' click using jQuery and js_injector module. Now, problem is solved! thanks Mar 30, 2011 at 20:29
  • Probably you added node/add/myform to the allowed paths for tokenauth, but not node/*. To avoid that, I would probably have changed the $form['#redirect'] to a page they could access. Sounds like you've got a handle on it though.
    – Grayside
    Mar 31, 2011 at 1:43
  • actually I added node/* but this module allows access only if URL is in the form node/40/?token=rbkrIlw9GX and after Drupal form is saved, it is redirect to node/40/ and not to node/40/?token=rbkrIlw9GX. I need to find a way to change value of $form['#redirect'] using javascript. Mar 31, 2011 at 15:11
  • node/* should work just fine. drupal.org/node/990468 tries to address the problem you are finding. Tokenauth is more intended for one off pageloads, not all Drupal interactions are properly accounted for.
    – Grayside
    Apr 3, 2011 at 7:16

There is currently a sandbox module called URL Login waiting to get approved to become a full project. See the project page and the full project application issue.

That module provides a secure way to log in through an URL. If that module is useful to you, I suggest you mention that in the linked issue so that it can become a full project soon.

  • This was very good option. It worked fine on my development machine, but not on production. I guess, our production site uses somewhat older PHP version. I was getting following error warning: base64_decode() expects exactly 1 parameter, 2 given in /portal/modules/urllogin/urllogin_security.inc on line 131. Mar 30, 2011 at 20:23
  • Yes, that was added with PHP 5.2.0. I suggest you report that in the project application issue, so that the author can either add the dependency on PHP 5.2 or implement a workaround.
    – Berdir
    Mar 30, 2011 at 20:40

Are you looking for one-time logins, allowing new users to login and set their own password? Try http://drupal.org/project/one_time_login

Some details from the module's project page:

This module adds two operations to the form at Administration >> People: "Send one-time login link to the selected users" and "Download CSV of one-time login URLs for the selected users".

This module also provides a Views field handler for one-time login URL and a "Send one-time login link to user" action for use with Views Bulk Operations.

  • No. I was looking for a way to take certain users to a protected page without need of entering username and password. Mar 30, 2011 at 20:32

I believe you are looking for the Secure Site module.

Although depending on your needs the Webserver Authentication module might work well also.

  • Unfortunately, I could not figure out how to login using URL with 'Secure Site' or 'Webserver Authentication' modules. 'tokenauto' and 'url_login' did work. Thanks for suggestion though. Mar 30, 2011 at 20:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.