Does adding ?.jpg after url really bypasses wifi security? And how?

Question

So I stumbled upon the following lifehack the other day:

Lifehack

I currently don't have access to an airport with expensive WiFi but it seems that adding ?.jpg to any url doesn't cause any problems with the page still loading.

Some questions come to mind:

Why does websites still load correctly after adding ?.jpg?
How would it bypass the type of WiFi security where you first need to add credit to continue browsing?

http://www.quickmeme.com/img/0c/0cf488d9f77a4dd34ac1ed2053d963b326d25eeec09ae444884804ffadfb251f.jpg — cjc, May 24 '14 at 12:13
This would not work at any captive portal I built. If it's true at all, it will only apply to some small subset of access points. — Michael Hampton, May 24 '14 at 13:51

score 2 · Accepted Answer · edited Oct 07 '21 at 06:58

In a URI, the question mark signals the end of the path portion of the URL and the beginning of the query string parameters.

Normally unrecognized query string parameters are simply ignored, which is why nothing broke when you tested adding ?.jpg.

As for why modifying the URL like this would change anything when connected to an open wifi hotspot that requires some kind of login or activation code my assumption would be:

This isn't something that works in general but rather something that works for some particular hotspot solution.
This solution where it does work would appear to have an http proxy or something similar that inspects requested URLs, query string and all, and allows anything that ends with .jpg even for clients that have not yet authenticated. (This check for the full URL, including query string, to end with .jpg would appear to be either a bug or a misconfiguration!)

Worth noting is that doing what this tip suggests seems like it could very well be illegal and as such is not such a great idea to suggest to people.

Does adding ?.jpg after url really bypasses wifi security? And how?

1 Answers1