Last Friday I talked about using a special user to allow Excel to login in to database. In response it was pointed out that passing credentials via the URL in this way is no longer supported by versions of IE with cumulative Security Update #832894 installed. The idea being to stop Phishers & co. from spoofing your bank's URL. If you tried to open a URL, like the one I posted, using IE you'd see this Invalid Syntax error (note it's not a Domino error):

Worry not though. This doesn't affect the solution. According to the How Things Work Department of my brain it's because Excel doesn't use IE to fetch the URL. Well, maybe it does in one way or another, but it doesn't seem to mind passing the user name and password.

However, there is a problem if you happen to be using session-based authentication on your server, as Curt pointed out in another response. If so, this method won't work anyway. Instead you have to pass the username and password as extra parameters in the query string, like so:

Another response pointed out that this is a "huge" security risk. I really don't think so and can't see how. The danger is that another use, who would otherwise be Anonymous, somehow accesses the user's PC and finds this URL. This they can do by searching the users internet cache folder for the cached .IQY "file", which they can open in a text editor and find the password. To do this they would need to know that this trickery was happening in the first place and how to look for and open this type of file. They would also need to be logged on to Windows as that user or as one with Administration rights. It's a small risk and, unless security is of the utmost importance, not one I'd lose sleep over. If they can access the user's cache they can read most of the content of the database anyway, unless it's made not to cache. Maybe they could see the URL in Domino logs? Again, only if they happen to have Admin rights.

Talking of cacheing, there's one more installment on these .IQY issues to come...