Re: [wdvltalk] url rewrite help needed

2008-10-20 Thread Ross Clutterbuck
Sounds to me that you'll have much better luck approaching this in a
much more secure way instead of trying to fudge through limited tools
available to you.

If this school is even partially serious about protecting its pupils
then they should be open to discussion and you can illustrate these
difficulties you're having and the best way to achieve this goal.

To be honest though if this sensitive information is run from the
school's intranet then either they need to set up a secure VPN so you
can dial-in directly to the intranet or you simply don't provide
external access - if the school wants this information accessible then
they should really give the pupils provision to access it within
school hours.

Just my opinion!

MOU

2008/10/20 Hassan Schroeder [EMAIL PROTECTED]:
 On Sun, Oct 19, 2008 at 5:43 PM, steve miller [EMAIL PROTECTED] wrote:

 The main info on the site is pw protected, but I'm hoping to increase
 security and settle some parents' anxiety by hiding it all together. It has
 trip signup info, contact info, pictures... and they don't want predators
 lurking.

 If it's online, it's not hidden.  :-)

 The only actual security is restricting access to authenticated users
 (with strong SSL login protection).

 Ask yourself this: can you tell parents that you're doing everything
 to protect those student resources that, say, their bank is doing to
 protect their account information? If not, then do it.

 But trying to hide a query string or URL is not doing anything for
 anyone. Really.  :-)

 FWIW,
 --
 Hassan Schroeder  [EMAIL PROTECTED]

  • The WDVL Discussion List from WDVL.COM • 
 To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED] or
 use the web interface http://e-newsletters.internet.com/discussionlists.html/
   Send Your Posts To: wdvltalk@lists.wdvl.com
 To change subscription settings, add a password or view the web interface:
 http://intm-dl.sparklist.com/read/?forum=wdvltalk

   http://www.wdvl.com  ___

 You are currently subscribed to wdvltalk as: [EMAIL PROTECTED]
 To unsubscribe send a blank email to [EMAIL PROTECTED]
 To unsubscribe via postal mail, please contact us at:
 Jupitermedia Corp.
 Attn: Discussion List Management
 475 Park Avenue South
 New York, NY 10016

 Please include the email address which you have been contacted with.


 � The WDVL Discussion List from WDVL.COM � 
To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED] or
use the web interface http://e-newsletters.internet.com/discussionlists.html/
   Send Your Posts To: wdvltalk@lists.wdvl.com
To change subscription settings, add a password or view the web interface:
http://intm-dl.sparklist.com/read/?forum=wdvltalk

  http://www.wdvl.com  ___

You are currently subscribed to wdvltalk as: [EMAIL PROTECTED]
To unsubscribe send a blank email to [EMAIL PROTECTED]
To unsubscribe via postal mail, please contact us at:
Jupitermedia Corp.
Attn: Discussion List Management
475 Park Avenue South
New York, NY 10016

Please include the email address which you have been contacted with.

Re: [wdvltalk] url rewrite help needed

2008-10-20 Thread steve miller
OK.
Thanks for the thoughts.


steve
On Oct 19, 2008, at 9:23 PM, Sheila Fenelon wrote:

 steve miller wrote:
 Hi Sheila.

 Guess I'm being thick here, but wouldn't the logged in visitor  
 still see
 the url to the intermediate script?
 Or are you thinking it will happen so fast that they won't be able to
 read it?



 Yes, exactly. Beside the URL is viewable on the protected site right?
 You can't hide it completely. It'll be in the browser's history as  
 well.


 On Oct 19, 2008, at 8:28 PM, Sheila Fenelon wrote:

 steve miller wrote:
 Guess I need to give more info.
 This is a private site that the school does not want accessed  
 via the
 open web.
 They don't have an intranet, so what we are doing is making it only
 available through a site that they contract (edline.net).
 In this way, school members log into edline first with a  
 username and
 pw, then they see the link to the private site.

 In order to keep general web visitors from even seeing the home  
 page, I
 am requiring a certain variable be present. If the variable is not
 present, we re-direct to the school site which is public.

 So the problem is that I don't even want the members to see the
 variable, or it might unintentionally get out.
 I don't even want them to know that a variable is being passed.  
 If they
 see the id in the url, they might pass it on and the result is  
 the same.

 So...I was hoping that somehow I could accept the variable but  
 hide it
 by re-writing the url.
 Is something like that possible?


 How about this? Use an intermediate script. The script that  
 checks for
 the variable sets a cookie and then redirects to the protected  
 page. The
 protected page checks for the cookie. If either check fails they
 redirect to the public site.

 Sheila
 -- 
 http://www.shefen.com/




  • The WDVL Discussion List from WDVL.COM • 
 To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED] 
 dl.sparklist.com or
 use the web interface http://e-newsletters.internet.com/ 
 discussionlists.html/
Send Your Posts To: wdvltalk@lists.wdvl.com
 To change subscription settings, add a password or view the web  
 interface:
 http://intm-dl.sparklist.com/read/?forum=wdvltalk

   http://www.wdvl.com  ___

 You are currently subscribed to wdvltalk as: [EMAIL PROTECTED]
 To unsubscribe send a blank email to  
 [EMAIL PROTECTED]
 To unsubscribe via postal mail, please contact us at:
 Jupitermedia Corp.
 Attn: Discussion List Management
 475 Park Avenue South
 New York, NY 10016

 Please include the email address which you have been contacted with.



 • The WDVL Discussion List from WDVL.COM • 
To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED] or
use the web interface http://e-newsletters.internet.com/discussionlists.html/
   Send Your Posts To: wdvltalk@lists.wdvl.com
To change subscription settings, add a password or view the web interface:
http://intm-dl.sparklist.com/read/?forum=wdvltalk

  http://www.wdvl.com  ___

You are currently subscribed to wdvltalk as: [EMAIL PROTECTED]
To unsubscribe send a blank email to [EMAIL PROTECTED]
To unsubscribe via postal mail, please contact us at:
Jupitermedia Corp.
Attn: Discussion List Management
475 Park Avenue South
New York, NY 10016

Please include the email address which you have been contacted with.


Re: [Bulk] Re: [wdvltalk] url rewrite help needed

2008-10-20 Thread Portman
I seem to remember someone saying that if you redirect a url and use 
masking, the real url won't show - is this true? (And an option?)


Riva

On 10/20/2008 8:49 AM, steve miller wrote:

OK.
Thanks for the thoughts.


steve


 • The WDVL Discussion List from WDVL.COM • 
To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED] or
use the web interface http://e-newsletters.internet.com/discussionlists.html/
  Send Your Posts To: wdvltalk@lists.wdvl.com
To change subscription settings, add a password or view the web interface:
http://intm-dl.sparklist.com/read/?forum=wdvltalk

  http://www.wdvl.com  ___

You are currently subscribed to wdvltalk as: [EMAIL PROTECTED]
To unsubscribe send a blank email to [EMAIL PROTECTED]
To unsubscribe via postal mail, please contact us at:
Jupitermedia Corp.
Attn: Discussion List Management
475 Park Avenue South
New York, NY 10016

Please include the email address which you have been contacted with.


Re: [wdvltalk] url rewrite help needed

2008-10-20 Thread steve miller

Couldn't agree more, but the school is not very up on technology yet.
We are actually a club of parents that support various school  
activities, like their music program.
We run trips and things to raise money, so we are not officially  
part of the school system.

The school has a basic site, but they don't do much with it.

We wrote an application to help us coordinate everything, and  
facilitate signups, $ tracking, etc.
We need the student IDs, names, grades, contact info, etc to make it  
all work.
Technically, the school's only involvement is to sanction it, share  
the student info, and give us a link from their edline account.


It would be different if the school initiated the project, but they  
didn't. So, our task is to make it as secure as possible in order to  
sell it to all the other parents. If they can google it and find  
it, they might not use it.


We have a secure login and a certificate on the site, so any  
sensitive info will be difficult to see. However, but we were hoping  
to make it difficult to even hit so parents would feel more  
comfortable. I know that we will never hide it completely, we just  
want to do the best we can.


steve




On Oct 20, 2008, at 5:26 AM, Ross Clutterbuck wrote:


Sounds to me that you'll have much better luck approaching this in a
much more secure way instead of trying to fudge through limited tools
available to you.

If this school is even partially serious about protecting its pupils
then they should be open to discussion and you can illustrate these
difficulties you're having and the best way to achieve this goal.

To be honest though if this sensitive information is run from the
school's intranet then either they need to set up a secure VPN so you
can dial-in directly to the intranet or you simply don't provide
external access - if the school wants this information accessible then
they should really give the pupils provision to access it within
school hours.

Just my opinion!

MOU



 • The WDVL Discussion List from WDVL.COM • 
To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED] or
use the web interface http://e-newsletters.internet.com/discussionlists.html/
  Send Your Posts To: wdvltalk@lists.wdvl.com
To change subscription settings, add a password or view the web interface:
http://intm-dl.sparklist.com/read/?forum=wdvltalk

  http://www.wdvl.com  ___

You are currently subscribed to wdvltalk as: [EMAIL PROTECTED]
To unsubscribe send a blank email to [EMAIL PROTECTED]
To unsubscribe via postal mail, please contact us at:
Jupitermedia Corp.
Attn: Discussion List Management
475 Park Avenue South
New York, NY 10016

Please include the email address which you have been contacted with.


Re: [Bulk] Re: [wdvltalk] url rewrite help needed

2008-10-20 Thread David Precious
On 10/20/2008 01:54 PM, Portman wrote:
 I seem to remember someone saying that if you redirect a url and use 
 masking, the real url won't show - is this true? (And an option?)

No.  You have to tell the browser what URL to go to, in order for it to
go to it.  There's no way to get the browser to go to an URL without
telling it what the URL is :)

 • The WDVL Discussion List from WDVL.COM • 
To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED] or
use the web interface http://e-newsletters.internet.com/discussionlists.html/
   Send Your Posts To: wdvltalk@lists.wdvl.com
To change subscription settings, add a password or view the web interface:
http://intm-dl.sparklist.com/read/?forum=wdvltalk

  http://www.wdvl.com  ___

You are currently subscribed to wdvltalk as: [EMAIL PROTECTED]
To unsubscribe send a blank email to [EMAIL PROTECTED]
To unsubscribe via postal mail, please contact us at:
Jupitermedia Corp.
Attn: Discussion List Management
475 Park Avenue South
New York, NY 10016

Please include the email address which you have been contacted with.


[wdvltalk] url rewrite help needed

2008-10-19 Thread steve miller

Hi all.

Could use some help with a url rewrite, if possible...

I am sending a variable from one site to another via a url string  
because I don't have access to send it as a form post variable.

Thus, the variable is viewable, like index.html?this=that.

I'd like to hide the variable value. Is it possible to send this  
string, but have it show in the url bar as something else, like  
index.html or index.html?this=gibberish so no one can easily see what  
I am sending?



Thanks!

Steve


 • The WDVL Discussion List from WDVL.COM • 
To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED] or
use the web interface http://e-newsletters.internet.com/discussionlists.html/
  Send Your Posts To: wdvltalk@lists.wdvl.com
To change subscription settings, add a password or view the web interface:
http://intm-dl.sparklist.com/read/?forum=wdvltalk

  http://www.wdvl.com  ___

You are currently subscribed to wdvltalk as: [EMAIL PROTECTED]
To unsubscribe send a blank email to [EMAIL PROTECTED]
To unsubscribe via postal mail, please contact us at:
Jupitermedia Corp.
Attn: Discussion List Management
475 Park Avenue South
New York, NY 10016

Please include the email address which you have been contacted with.


Re: [wdvltalk] url rewrite help needed

2008-10-19 Thread Hassan Schroeder
On Sun, Oct 19, 2008 at 9:10 AM, steve miller [EMAIL PROTECTED] wrote:

 I am sending a variable from one site to another via a url string because I
 don't have access to send it as a form post variable.
 Thus, the variable is viewable, like index.html?this=that.

 I'd like to hide the variable value. Is it possible to send this string, but
 have it show in the url bar as something else, like index.html or
 index.html?this=gibberish so no one can easily see what I am sending?

You can encrypt the value, as long as the other server processing
the request knows how to unencrypt it.

But why exactly can't you just post it?

-- 
Hassan Schroeder  [EMAIL PROTECTED]

 • The WDVL Discussion List from WDVL.COM • 
To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED] or
use the web interface http://e-newsletters.internet.com/discussionlists.html/
   Send Your Posts To: wdvltalk@lists.wdvl.com
To change subscription settings, add a password or view the web interface:
http://intm-dl.sparklist.com/read/?forum=wdvltalk

  http://www.wdvl.com  ___

You are currently subscribed to wdvltalk as: [EMAIL PROTECTED]
To unsubscribe send a blank email to [EMAIL PROTECTED]
To unsubscribe via postal mail, please contact us at:
Jupitermedia Corp.
Attn: Discussion List Management
475 Park Avenue South
New York, NY 10016

Please include the email address which you have been contacted with.


Re: [wdvltalk] url rewrite help needed

2008-10-19 Thread steve miller

Hi Hassan.

The other site is a commercial site that our school uses (edline.net)  
and they (so far) are only allowing us to post links on their site,  
not forms. Since I am not the school's contact with edline, I can't  
ask directly, and the person who is the contact is not being very  
helpful.


If I had server or site access (or just a helpful tech), I could do  
lots of things, but no luck. So, I am stuck with a simple url and I'd  
like to hide the variable being sent.


steve


On Oct 19, 2008, at 12:58 PM, Hassan Schroeder wrote:

On Sun, Oct 19, 2008 at 9:10 AM, steve miller [EMAIL PROTECTED]  
wrote:


I am sending a variable from one site to another via a url string  
because I

don't have access to send it as a form post variable.
Thus, the variable is viewable, like index.html?this=that.

I'd like to hide the variable value. Is it possible to send this  
string, but

have it show in the url bar as something else, like index.html or
index.html?this=gibberish so no one can easily see what I am sending?


You can encrypt the value, as long as the other server processing
the request knows how to unencrypt it.

But why exactly can't you just post it?

--
Hassan Schroeder  [EMAIL PROTECTED]



 • The WDVL Discussion List from WDVL.COM • 
To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED] or
use the web interface http://e-newsletters.internet.com/discussionlists.html/
  Send Your Posts To: wdvltalk@lists.wdvl.com
To change subscription settings, add a password or view the web interface:
http://intm-dl.sparklist.com/read/?forum=wdvltalk

  http://www.wdvl.com  ___

You are currently subscribed to wdvltalk as: [EMAIL PROTECTED]
To unsubscribe send a blank email to [EMAIL PROTECTED]
To unsubscribe via postal mail, please contact us at:
Jupitermedia Corp.
Attn: Discussion List Management
475 Park Avenue South
New York, NY 10016

Please include the email address which you have been contacted with.


Re: [wdvltalk] url rewrite help needed

2008-10-19 Thread Hassan Schroeder
On Sun, Oct 19, 2008 at 1:30 PM, steve miller [EMAIL PROTECTED] wrote:

 they (so far) are only allowing us to post links on their site, not forms.
/
 So, I am stuck with a simple url and I'd like to hide
 the variable being sent.

OK, got it. If it were me, I'd probably just put the values in question in
a lookup table with an associated ID and put the ID in the URL.

Since the relationship of the ID and value is arbitrary, there's no way
to derive the value (without following the link, at which point I'd think
it would be apparent, but maybe not).

Anyway, HTH!

H*
-- 
Hassan Schroeder  [EMAIL PROTECTED]

 • The WDVL Discussion List from WDVL.COM • 
To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED] or
use the web interface http://e-newsletters.internet.com/discussionlists.html/
   Send Your Posts To: wdvltalk@lists.wdvl.com
To change subscription settings, add a password or view the web interface:
http://intm-dl.sparklist.com/read/?forum=wdvltalk

  http://www.wdvl.com  ___

You are currently subscribed to wdvltalk as: [EMAIL PROTECTED]
To unsubscribe send a blank email to [EMAIL PROTECTED]
To unsubscribe via postal mail, please contact us at:
Jupitermedia Corp.
Attn: Discussion List Management
475 Park Avenue South
New York, NY 10016

Please include the email address which you have been contacted with.


Re: [wdvltalk] url rewrite help needed

2008-10-19 Thread steve miller

Guess I need to give more info.
This is a private site that the school does not want accessed via the  
open web.
They don't have an intranet, so what we are doing is making it only  
available through a site that they contract (edline.net).
In this way, school members log into edline first with a username and  
pw, then they see the link to the private site.


In order to keep general web visitors from even seeing the home page,  
I am requiring a certain variable be present. If the variable is not  
present, we re-direct to the school site which is public.


So the problem is that I don't even want the members to see the  
variable, or it might unintentionally get out.
I don't even want them to know that a variable is being passed. If  
they see the id in the url, they might pass it on and the result is  
the same.


So...I was hoping that somehow I could accept the variable but hide  
it by re-writing the url.

Is something like that possible?

steve



OK, got it. If it were me, I'd probably just put the values in  
question in

a lookup table with an associated ID and put the ID in the URL.

Since the relationship of the ID and value is arbitrary, there's no  
way
to derive the value (without following the link, at which point I'd  
think

it would be apparent, but maybe not).

Anyway, HTH!

H*
--
Hassan Schroeder  [EMAIL PROTECTED]



 • The WDVL Discussion List from WDVL.COM • 
To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED] or
use the web interface http://e-newsletters.internet.com/discussionlists.html/
  Send Your Posts To: wdvltalk@lists.wdvl.com
To change subscription settings, add a password or view the web interface:
http://intm-dl.sparklist.com/read/?forum=wdvltalk

  http://www.wdvl.com  ___

You are currently subscribed to wdvltalk as: [EMAIL PROTECTED]
To unsubscribe send a blank email to [EMAIL PROTECTED]
To unsubscribe via postal mail, please contact us at:
Jupitermedia Corp.
Attn: Discussion List Management
475 Park Avenue South
New York, NY 10016

Please include the email address which you have been contacted with.


Re: [wdvltalk] url rewrite help needed

2008-10-19 Thread Sheila Fenelon
steve miller wrote:
 Guess I need to give more info.
 This is a private site that the school does not want accessed via the
 open web.
 They don't have an intranet, so what we are doing is making it only
 available through a site that they contract (edline.net).
 In this way, school members log into edline first with a username and
 pw, then they see the link to the private site.
 
 In order to keep general web visitors from even seeing the home page, I
 am requiring a certain variable be present. If the variable is not
 present, we re-direct to the school site which is public.
 
 So the problem is that I don't even want the members to see the
 variable, or it might unintentionally get out.
 I don't even want them to know that a variable is being passed. If they
 see the id in the url, they might pass it on and the result is the same.
 
 So...I was hoping that somehow I could accept the variable but hide it
 by re-writing the url.
 Is something like that possible?
 

How about this? Use an intermediate script. The script that checks for
the variable sets a cookie and then redirects to the protected page. The
protected page checks for the cookie. If either check fails they
redirect to the public site.

Sheila
--
http://www.shefen.com/



 • The WDVL Discussion List from WDVL.COM • 
To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED] or
use the web interface http://e-newsletters.internet.com/discussionlists.html/
   Send Your Posts To: wdvltalk@lists.wdvl.com
To change subscription settings, add a password or view the web interface:
http://intm-dl.sparklist.com/read/?forum=wdvltalk

  http://www.wdvl.com  ___

You are currently subscribed to wdvltalk as: [EMAIL PROTECTED]
To unsubscribe send a blank email to [EMAIL PROTECTED]
To unsubscribe via postal mail, please contact us at:
Jupitermedia Corp.
Attn: Discussion List Management
475 Park Avenue South
New York, NY 10016

Please include the email address which you have been contacted with.


Re: [wdvltalk] url rewrite help needed

2008-10-19 Thread steve miller

Hi Sheila.

Guess I'm being thick here, but wouldn't the logged in visitor still  
see the url to the intermediate script?
Or are you thinking it will happen so fast that they won't be able to  
read it?


steve


On Oct 19, 2008, at 8:28 PM, Sheila Fenelon wrote:


steve miller wrote:

Guess I need to give more info.
This is a private site that the school does not want accessed via the
open web.
They don't have an intranet, so what we are doing is making it only
available through a site that they contract (edline.net).
In this way, school members log into edline first with a username and
pw, then they see the link to the private site.

In order to keep general web visitors from even seeing the home  
page, I

am requiring a certain variable be present. If the variable is not
present, we re-direct to the school site which is public.

So the problem is that I don't even want the members to see the
variable, or it might unintentionally get out.
I don't even want them to know that a variable is being passed. If  
they
see the id in the url, they might pass it on and the result is the  
same.


So...I was hoping that somehow I could accept the variable but  
hide it

by re-writing the url.
Is something like that possible?



How about this? Use an intermediate script. The script that checks for
the variable sets a cookie and then redirects to the protected  
page. The

protected page checks for the cookie. If either check fails they
redirect to the public site.

Sheila
--
http://www.shefen.com/




 • The WDVL Discussion List from WDVL.COM • 
To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED] or
use the web interface http://e-newsletters.internet.com/discussionlists.html/
  Send Your Posts To: wdvltalk@lists.wdvl.com
To change subscription settings, add a password or view the web interface:
http://intm-dl.sparklist.com/read/?forum=wdvltalk

  http://www.wdvl.com  ___

You are currently subscribed to wdvltalk as: [EMAIL PROTECTED]
To unsubscribe send a blank email to [EMAIL PROTECTED]
To unsubscribe via postal mail, please contact us at:
Jupitermedia Corp.
Attn: Discussion List Management
475 Park Avenue South
New York, NY 10016

Please include the email address which you have been contacted with.


Re: [wdvltalk] url rewrite help needed

2008-10-19 Thread steve miller



On Oct 19, 2008, at 8:37 PM, Hassan Schroeder wrote:

On Sun, Oct 19, 2008 at 4:58 PM, steve miller [EMAIL PROTECTED]  
wrote:


In this way, school members log into edline first with a username  
and pw,

then they see the link to the private site.


So, I'm hoping I understand this correctly -- the edline site is  
password
protected but the other site isn't? You're just trying to keep it  
on the QT,

i.e., security though obscurity?


yep.





So...I was hoping that somehow I could accept the variable but  
hide it by

re-writing the url.
Is something like that possible?


No. Anything in the query string is visible, period, even if  
obfuscated.


Darn.




If you want to keep your internal site private, you need to password
protect it.



The main info on the site is pw protected, but I'm hoping to increase  
security and settle some parents' anxiety by hiding it all together.  
It has trip signup info, contact info, pictures... and they don't  
want predators lurking.


steve



 • The WDVL Discussion List from WDVL.COM • 
To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED] or
use the web interface http://e-newsletters.internet.com/discussionlists.html/
  Send Your Posts To: wdvltalk@lists.wdvl.com
To change subscription settings, add a password or view the web interface:
http://intm-dl.sparklist.com/read/?forum=wdvltalk

  http://www.wdvl.com  ___

You are currently subscribed to wdvltalk as: [EMAIL PROTECTED]
To unsubscribe send a blank email to [EMAIL PROTECTED]
To unsubscribe via postal mail, please contact us at:
Jupitermedia Corp.
Attn: Discussion List Management
475 Park Avenue South
New York, NY 10016

Please include the email address which you have been contacted with.


Re: [wdvltalk] url rewrite help needed

2008-10-19 Thread Sheila Fenelon
steve miller wrote:
 Hi Sheila.
 
 Guess I'm being thick here, but wouldn't the logged in visitor still see
 the url to the intermediate script?
 Or are you thinking it will happen so fast that they won't be able to
 read it?
 
 

Yes, exactly. Beside the URL is viewable on the protected site right?
You can't hide it completely. It'll be in the browser's history as well.

 
 On Oct 19, 2008, at 8:28 PM, Sheila Fenelon wrote:
 
 steve miller wrote:
 Guess I need to give more info.
 This is a private site that the school does not want accessed via the
 open web.
 They don't have an intranet, so what we are doing is making it only
 available through a site that they contract (edline.net).
 In this way, school members log into edline first with a username and
 pw, then they see the link to the private site.

 In order to keep general web visitors from even seeing the home page, I
 am requiring a certain variable be present. If the variable is not
 present, we re-direct to the school site which is public.

 So the problem is that I don't even want the members to see the
 variable, or it might unintentionally get out.
 I don't even want them to know that a variable is being passed. If they
 see the id in the url, they might pass it on and the result is the same.

 So...I was hoping that somehow I could accept the variable but hide it
 by re-writing the url.
 Is something like that possible?


 How about this? Use an intermediate script. The script that checks for
 the variable sets a cookie and then redirects to the protected page. The
 protected page checks for the cookie. If either check fails they
 redirect to the public site.

 Sheila
 -- 
 http://www.shefen.com/




 • The WDVL Discussion List from WDVL.COM • 
To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED] or
use the web interface http://e-newsletters.internet.com/discussionlists.html/
   Send Your Posts To: wdvltalk@lists.wdvl.com
To change subscription settings, add a password or view the web interface:
http://intm-dl.sparklist.com/read/?forum=wdvltalk

  http://www.wdvl.com  ___

You are currently subscribed to wdvltalk as: [EMAIL PROTECTED]
To unsubscribe send a blank email to [EMAIL PROTECTED]
To unsubscribe via postal mail, please contact us at:
Jupitermedia Corp.
Attn: Discussion List Management
475 Park Avenue South
New York, NY 10016

Please include the email address which you have been contacted with.


Re: [wdvltalk] url rewrite help needed

2008-10-19 Thread Hassan Schroeder
On Sun, Oct 19, 2008 at 5:43 PM, steve miller [EMAIL PROTECTED] wrote:

 The main info on the site is pw protected, but I'm hoping to increase
 security and settle some parents' anxiety by hiding it all together. It has
 trip signup info, contact info, pictures... and they don't want predators
 lurking.

If it's online, it's not hidden.  :-)

The only actual security is restricting access to authenticated users
(with strong SSL login protection).

Ask yourself this: can you tell parents that you're doing everything
to protect those student resources that, say, their bank is doing to
protect their account information? If not, then do it.

But trying to hide a query string or URL is not doing anything for
anyone. Really.  :-)

FWIW,
-- 
Hassan Schroeder  [EMAIL PROTECTED]

 • The WDVL Discussion List from WDVL.COM • 
To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED] or
use the web interface http://e-newsletters.internet.com/discussionlists.html/
   Send Your Posts To: wdvltalk@lists.wdvl.com
To change subscription settings, add a password or view the web interface:
http://intm-dl.sparklist.com/read/?forum=wdvltalk

  http://www.wdvl.com  ___

You are currently subscribed to wdvltalk as: [EMAIL PROTECTED]
To unsubscribe send a blank email to [EMAIL PROTECTED]
To unsubscribe via postal mail, please contact us at:
Jupitermedia Corp.
Attn: Discussion List Management
475 Park Avenue South
New York, NY 10016

Please include the email address which you have been contacted with.