I need a solution. The solution is probably more about configuration of existing software rather than new code but whatever can work in my environment.

The challenge:
I have a number of internet resources controlled by username password access.
Within those resources are pages that I need to give access to contractors But there are other pages (admin page, config change pages) that I do NOT want to give access to.

For example: http://myprotectedSite.com/ user=User1 password=password1 Under http://myprotectedSite.com/ in the simple case we have pages http://myprotectedSite.com/page1.html http://myprotectedSite.com/page2.html http://myprotectedSite.com/adminarea.html

In this case I want to allow access to Page1.html and page2.html freely but restrict/prevent access to adminarea.html That is the simplest use case. In other cases the resources I want to secure might be identified by some attribute on the page if loaded by say Ajax and the url did not change.
Anyway I do not want to simply share the username/password as that will give access to the pages I do not want give access to as well as those I do.

Solution Direction 1: Perhaps this could be done with some kind of proxy server. I load the proxy server with the access credentials and with the stop urls for the pages I do not want give access to. I then give (non admin) access to proxy server to contractors and from there the proxy server serves the pages I want. This assume a proxy server could block access to specific pages with sites not just whole sites. However I am working in a cpanel shared hosting environment so do not have control of the underlying machine. Instead I would need like a node.js or php proxy server or any proxy I could install in a typical cpanel hosting environment.

Solution Direction 2: This could be like a watchdog solution. An iframe with javascript sitting in the top frame. The javascript calls the password protected resources into the lower frame. Then watches the urls and content in lower frame for any restricted content (polling every few seconds (obviously not ideal from a performance point of view). It then substitutes the location of restricted pages with the unrestricted home page. In the case that restricted pages as identified by URL this is not so difficult. However if the pages are being loaded by Ajax or other mechanisms it might mean calling a small custom function (like isRestrictedPage() that knows how to identify the restricted pages )
Securing the credentials from inspection in the browser will be important.

These are two solution directions. The answer does not need to be either of these. Anything that works to get the result I need. I will try to put together a test case shortly and update this posting with test case info but that may be a day or three from now. I will make every attempt to respond to each response but if I do not please accept my thanks in advance and apologies that I was unable to respond further.

Thanks and regards Ivor

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.