Re: [PHP] How to secure this

Michael A. Peters wrote:
> John Allsopp wrote:
> 
>> Well no they are not logged in, it's just an embedded iframe so that's 
>> my main issue with my method, anyone could look at the web page 
>> source, pinch the URL of the iframe and they'd have the username and 
>> password.
> 
> I think the only way to do it is to make a key per referring url and use 
> the key as a get variable.
> 
> Either the referring url matches the key or it doesn't.
> 
> That should work with an object/iframe embedding of a resource, browsers 
> by default send the referrer header.

Except when the object is handled by a plugin, they are notorious for 
not sending that header (and thus IMHO are broken). But it sounds like 
the resource you are providing is not requested by a plugin.