Simple way to bypass the login?

[manybuddhas]

Entering the address of the Subsonic service on my Web server, which let's say is at http://66.185.19.125:8083/, takes me directly to the index rather than the log-in page, and provides access to all the functions in Subsonic.

If you remove the arguments after the http address: /login.view;jsessionid=qkzqn8cqqcc? you can just enter the index without having to log in.

I changed the admin password as described, but still this simple bypass is available. What am I missing?[/code]

[kdid]

Have you tried that from a webbrowser that never have been used on you site?

It could be you have saved the login info in a cookie in your browser and it is using that in that case.

[aphuey]

Yeah - I bet if you clear your temp files, you will be forced to log in again...

[mixmaster]

There is a checkbox on the login page that allows you to choose between remembering your login or not.
________

[manybuddhas]

Thanks all. It was just a cookie, apparently, since the problem did not show up on a computer that hadn't accessed the site before.

[bluetooth]

From the tutorial section:

http://yourhost/subsonic/login.view?use ... word=guest