Solved

authentication via link from specific site

Posted on 2006-11-09
8
202 Views
Last Modified: 2013-12-24
Hi,

I have a client that wants our company to set up a link to access directly a secure area in our web site with:
1) only links coming from their site will be accepted (say www.clientssite.com)
2) all the logging informatoin has to be in the link and ecrypted

I know it's a two part question & if it gets too complicated instead of splitting the points I could open a second one for part two.

any suggestion to get started?
0
Comment
Question by:Shawn
8 Comments
 
LVL 13

Expert Comment

by:usachrisk1983
ID: 17913460
As far as only links coming from their site, you can looks at your CGI scope for the referer.  If it doesn't start with www.clientsite.com, reject it.  Problems: This relies on your website and the clients browser to support this.  Most do, but something to think about.  Also, since this is browser based, a user could potentially fake it.

Do you mean login information (not logging?)?  In either case, you just need to each decide how this information should be encrypted.  There are CF encrypt functions, you can hash, or you can come up with your own type of encryption.
0
 
LVL 7

Expert Comment

by:ExpertAdmin
ID: 17914468
I would handle the "allow" part with the web server itself. For example, in IIS you can set an allow list by IP or domain name.

As far as encrypting the information in the URL, that is only going to be as good as your encryption routine. Keep in mind also that some browsers limit the length of the URL, so you could run into problems there.

I would look at some sample encryption scripts. Your best bet will probably be to create a function that runs a block of Java code to do the encryption and unencryption. There may even be some encryption support built into Java, which would simplify things a lot.

You may also be able to use CFENCRYPT. Here is a thread about it:

http://www.experts-exchange.com/Web/WebDevSoftware/ColdFusion/Q_21702753.html

M@
0
 
LVL 39

Accepted Solution

by:
gdemaria earned 500 total points
ID: 17914746

 For #2)  This sounds like a single sign-on type setup.   If so, I've done it a bit diferrent way that I have done this is to pass the user ID and a hash value instead of the username and password.  This of course, presumes that the user ID can be determined from both sides.   So here's how it works...

  User logins in and is validated, his unique ID is hashed together with his password and a secret keyword both sides know.   These two values are passed.

  id=123&h=AKJGHS09843LKJLKJ987LAKGLKMN6879KHLLKK

 On the secure side, the user ID is looked up and the hash passed in is compared with the hashing of the user id along with the password and the secret keyword.  

 This can't be decrypted.

 By the way, the secret keyword could be some type of date/time so that it changes frequently

 This may not work in your situation, but thought I would suggest it in case...

0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 13

Expert Comment

by:usachrisk1983
ID: 17915012
Regarding letting IIS handle this, the IIS IP and Domain Restrictions are based on the clients IP or domain, and not the referring site, so this will not work in this situation.
0
 
LVL 1

Author Comment

by:Shawn
ID: 18125171
Hi,

I'm actually still working on it & would like you to keep it open for a little while. I'll add more comments within te next week.

thank you, Shawn
0
 
LVL 1

Author Comment

by:Shawn
ID: 18282105
I used a similar solution to gdemaria  (thank you)...a link with a key, expiry date, and an email to me for testing puposes.
0

Featured Post

Scale it in WD Gold

With up to ten times the workload capacity of desktop drives, WD Gold hard drives employ advanced technology to deliver among the best in reliability, capacity, power efficiency and performance.

Join & Write a Comment

In our day to day coding, how many times have we come across a necessity to check whether a URL is a broken link or not? For those of you that answered countless and are using ColdFusion like myself, then this article is for you.  It will show yo…
One of the typical problems I have experienced is when you have to move a web server from one hosting site to another. You normally prepare all on the new host, transfer the site, change DNS and cross your fingers hoping all will be ok on new server…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now