Secure Gmail login on web browser from external Java program

Question

Is there a secure way of logging into a Gmail account on a web browser, from an external Java program? I know the following works, but is there a safer alternative?

Desktop.getDesktop().browse(new URI(
        "https://www.google.com/accounts/ServiceLoginAuth?continue=http://mail.google.com/gmail" +
        "&service=mail&Email=LOGIN&Passwd=PASSWORD&null=Sign+in"));

Clarification: The external Java program is GmailAssistant, a Gmail notifier that already uses the IMAP capabilities of JavaMail. I just need a way of allowing the user to access the account directly in a web browser.

Answer 1

If you are afraid that the link is visible in the Page, create a javascript document that sends a POST request to the server.

Answer 2

Depending of how much you want to integrate, you can check Google single sign-on (SSO) api. I'm studing how to use it and the best way to integrate it

http://code.google.com/apis/apps/sso/saml_reference_implementation.html

Victor

UPDATED:

As a better option, you should check this link as well http://esoeproject.org/

Answer 3

If you want to programmatically access the content of a GMail account, I would strongly suggest to use the IMAP access provided by Google.

Looking at the question the other way around, you can setup an OpenID authentication scheme based on your Google account.

Answer 4

If you're really wanting to control a browser from Java, you'll have to use a web-connector such as Selenium or WebDriver. Both of these let you control a browser directly from within Java and simulate a user typing text, clicking on links and submitting forms. One thing to keep in mind when doing this with Selenium is that it interacts with a complete new profile which is usually independent of your standard Firefox probile.

Answer 5

I used google's IMAP access with the JavaMail API, and it was very simple.

Answer 6

If you're worried about the URL being sent for the login, understand that:

1. https:// starts with www.google.com and will encrypt the session before
2. sending the login details (or even the page it's going to