authentication via link from specific site


I have a client that wants our company to set up a link to access directly a secure area in our web site with:
1) only links coming from their site will be accepted (say
2) all the logging informatoin has to be in the link and ecrypted

I know it's a two part question & if it gets too complicated instead of splitting the points I could open a second one for part two.

any suggestion to get started?
Who is Participating?
gdemariaConnect With a Mentor Commented:

 For #2)  This sounds like a single sign-on type setup.   If so, I've done it a bit diferrent way that I have done this is to pass the user ID and a hash value instead of the username and password.  This of course, presumes that the user ID can be determined from both sides.   So here's how it works...

  User logins in and is validated, his unique ID is hashed together with his password and a secret keyword both sides know.   These two values are passed.


 On the secure side, the user ID is looked up and the hash passed in is compared with the hashing of the user id along with the password and the secret keyword.  

 This can't be decrypted.

 By the way, the secret keyword could be some type of date/time so that it changes frequently

 This may not work in your situation, but thought I would suggest it in case...

As far as only links coming from their site, you can looks at your CGI scope for the referer.  If it doesn't start with, reject it.  Problems: This relies on your website and the clients browser to support this.  Most do, but something to think about.  Also, since this is browser based, a user could potentially fake it.

Do you mean login information (not logging?)?  In either case, you just need to each decide how this information should be encrypted.  There are CF encrypt functions, you can hash, or you can come up with your own type of encryption.
I would handle the "allow" part with the web server itself. For example, in IIS you can set an allow list by IP or domain name.

As far as encrypting the information in the URL, that is only going to be as good as your encryption routine. Keep in mind also that some browsers limit the length of the URL, so you could run into problems there.

I would look at some sample encryption scripts. Your best bet will probably be to create a function that runs a block of Java code to do the encryption and unencryption. There may even be some encryption support built into Java, which would simplify things a lot.

You may also be able to use CFENCRYPT. Here is a thread about it:

Easily Design & Build Your Next Website

Squarespace’s all-in-one platform gives you everything you need to express yourself creatively online, whether it is with a domain, website, or online store. Get started with your free trial today, and when ready, take 10% off your first purchase with offer code 'EXPERTS'.

Regarding letting IIS handle this, the IIS IP and Domain Restrictions are based on the clients IP or domain, and not the referring site, so this will not work in this situation.
ShawnAuthor Commented:

I'm actually still working on it & would like you to keep it open for a little while. I'll add more comments within te next week.

thank you, Shawn
ShawnAuthor Commented:
I used a similar solution to gdemaria  (thank you)...a link with a key, expiry date, and an email to me for testing puposes.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.