For example in case the site relies on and loads some external JS (such as jQuery via CDN). Quite technical but any insights are highly appreciated. Thanks.


At this point in time, it doesn't.

There's an issue to fix this in Drupal 8, after which it will (hopefully) be ported back to 7. Patches are currently awaiting review.

  • Thanks for the fast reply. I posted the question because I am considering enabling some sort of URL path login system based on long auth key like this: /login/--{long alpha-numeric string}-- Each user should have unique auth key. The moment he loads the URL, Drupal loads the $uid of the user that has that unique key value defined inside some custom field and logs him as that user, and then redirects him to some privileged member area. All done over HTTPS. My tests suggest that the validation and login in code happens before loading some external JS file. So no auth key gets passed remotely.
    – W.M.
    Apr 5 '16 at 12:37
  • If the redirect is happening before any HTML is delivered to the browser (i.e. before any external requests can be made for the page whose URL contains the key), then you don't have anything to worry about, no
    – Clive
    Apr 5 '16 at 12:49
  • Thanks @Clive .. I am considering now validating the auth-key in pure SQL and if the key is found, only then I would bootstrap Drupal, login in code using "user_login_finalize()" and at the next line of code I would execute drupal_goto(). I think all of this doesn't involve any HTML rendering.
    – W.M.
    Apr 5 '16 at 12:57
  • Couldn't hurt - also make sure you're using https or all of these security measures are moot ;)
    – Clive
    Apr 5 '16 at 12:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.