Re: [PHP] How to secure this

John Allsopp wrote:

> Well no they are not logged in, it's just an embedded iframe so that's 
> my main issue with my method, anyone could look at the web page source, 
> pinch the URL of the iframe and they'd have the username and password.

I think the only way to do it is to make a key per referring url and use 
the key as a get variable.

Either the referring url matches the key or it doesn't.

That should work with an object/iframe embedding of a resource, browsers 
by default send the referrer header.

A user may turn that off in a browser, but if a user turns that off, the 
user is denied the resource because they changed a default setting. Kind 
of like how I don't get some resources when I turn JavaScript off.