hiding the URL!?

[peternemo77]

Hi!...plse help...

I am unsure of the best approach to a problem I need to overcome.
Basically I auto e-mail my user community a URL for their particular entry on a database when a ticket is raised for them, this URL contains an ID to the record each user needs to access (searches). The problem is a User can modify the URL to see other entires simply by changing the ID...The app generates its own pages and interfering with the Java behind these pages would be inappropriate. What I was wondering is whether there was a method by which I could hide the URL in the address bar perhaps by using frames somehow passing the ID as a variable from the email that I can construct?...or have some kind of script to hide the URL or redirect the page somehow?...can anybody suggest a good approach or point me in the right direction the ID will change everytime?...I know this might sound a little odd but it's all I have to work with with the app I have...

thanks

P

[Banfa]

I don't know for sure but the methods you suggest would only stop someone with little IT knowledge from viewing the URL.

For instance you could use a frameset, the url you want hidden would not appear in the address bar, however it would be in the text of the frameset and all a user would have to do to find that url would be to view the source of the frameset.

I would suggest having both the ID and username in the URL and only displaying the data if the ID matches the username, this way your users can not just change the ID to view someone elses data. Of course this would not work in a office environment where some could easily guess another persons username.

Alternitively trust your users?

[Niheel]

You could create a random 10 character key with each ticket ID. Send the key with the ID in the URL. When you show the ticket via the browser check to makesure that the ticket ID matches the random key. It's hard for people to guess random keys.

example URL:

 http://www.mydomain.com/ticket.php?ticketid=3232&rkey=d484kafq46

[peternemo77]

You could create a random 10 character key with each ticket ID. Send the key with the ID in the URL. When you show the ticket via the browser check to makesure that the ticket ID matches the random key. It's hard for people to guess random keys.

example URL:

 http://www.mydomain.com/ticket.php?ticketid=3232&rkey=d484kafq46

Thanks for the feedback...however I have already been down that route. Basically a generic U/P are used along with the ID in the URL, and I know it sounds a bit strange, I can't pass a key like this because of various constraints with the app...all I can do is somehow redirect the URL...I was thinking of some sort of script to control the URL from a redirect somehow but can't figure out how to perform the query against the database and show the results and hide the ID?...I thought of the frame idea (RE:Banfa) also because I was looking into how to have the frame show the query meaning the URL would be hidden in the page for users not to see - I thought perhaps I could somehow hide the URL within the page or simply allow users to see the URL (if they really wanted - it's different if it's in the actual address bar) It's only an Intranet page - however I would like some code advice on either of these two approaches if possible...

R

[Niheel]

Well if a generic(not actual employee's username/password) are passed along with the ticketid then you are safe. As long as the generic password and username isn't the same for every ticket.

Also, it's a intranet so you are somewhat in the clear. As far as redirects; i don't know what you would redirect to cuz you need an identifier such as the ticketid to tell you what ticket to display.

For this to be truly secure you need a key/hash that is random. Or request that the employee login with their username and password(real) before they can view their ticket.