invisible auto-login to remote website

[AlexandreAmant]

Hi,

I'd like to show a page to a visitor that is protected by .htaccess, without giving him my login/password.

What language should I use for this ?

I've seen that MS has now patched the usage userass@url_to_visit in IE so this is a no way as most webusers are on IE.

Anyone with a good solution that would not compromise my password ? I guess it must be done on the server side, but I don't know which language to use for that.

Thanks !

 

[Wullie]

Hi mate,

I thought the same thing, but figured it was a resller type of account where the stats are only provided for the reseller to use and not the clients.

I guess we need to get AlexandreAmant to fill us in.

Hope this helps

Wullie

http://www.freshlookhosting.com

http://www.tutorial-world.com

http://www.freshlookdesign.co.uk

The pessimist complains about the wind. The optimist expects it to change. The leader adjusts the sails. - John Maxwell

 

[tviman]

Yeah, I thought that, too, but then shouldn't the reseller be "invisible" to the end user?

There's always a better way. The fun is trying to find it!

 

[AlexandreAmant]

Hi all,

Yes, you figured it our correctly: I resell hosting and only my master login can access the stats of my clients.

I've done some tests, and apparenlty I need to create a kind of proxy server that will pull the urchin from the site and display it where I want it to be displayed. Otherwise pictures won't be displayed and I don't know about the javascript urchin uses.

It is currently Urchin v3.

What I'm trying to do will be *plus or minus* invisible to the end-user, because they'll login to my site and then get their own stats as if the stats were on my site.

Is there a way to create such a thing in PHP ?

 

[tviman]

AlexandreAmant,

another question - once your users gain access to the logs, how will they actually access their logs?

There's always a better way. The fun is trying to find it!

 

[Wullie]

Ok, still waiting for an answer to the following question.

Also, is this password really sensitive to you or do you just not want your clients accessing any other client's stats? What I mean by this is can you supply us with a login to test some methods? (Obviously don't just post the password here though)

I have a few thoughts on how this could be accomplished, but it depends on a few things. How many clients are we talking about?

One other question that just seems to obvious to me. Why can't your host provide different logins to the stats for your clients?

Hope this helps

Wullie

http://www.freshlookhosting.com

http://www.tutorial-world.com

http://www.freshlookdesign.co.uk

The pessimist complains about the wind. The optimist expects it to change. The leader adjusts the sails. - John Maxwell

 

[tviman]

Why can't your host provide different logins to the stats for your clients?

I was thinking the exact same thing!

There's always a better way. The fun is trying to find it!

 

[AlexandreAmant]

Why can't they provide separate logins for the stats ???

Right, the headache started with this question I've asked myself....

Anyway, this is how it is, so I need to deal with it.

Wullie: yes my password is quite sensitive, I'd like not to disclose it. We are talking about 20 clients for the moment, but expanding at a rate of 5 per month.

tviman: the logs are displayed in graphical format with a javascript code that allows you to select what you want to see (# visitors, wherefrom, ...). It's quite nice, I can try to send a screenshot if you want.

Something else: how do you "quote" someone in this forum ?

Thanks.

 

[tviman]

AlexandreAmant

the logs are displayed in graphical format with a javascript code that allows you to select what you want to see (# visitors, wherefrom, ...). It's quite nice, I can try to send a screenshot if you want.

What I meant was, how do you differentiate between your user's accounts when you access the reports. This might be the key to solving your problem. Here's my thinking...

Suppose you have a form on your website that the users access to see their stats. It would be a simple set-up:

<form method="post" action="[URL unfurl="true"]www.yoursite.com/cgi-bin/stats.cgi"><input[/URL] type="text" name="username"><br><input type="submit" name="Get Stats"></form>

"username" would be whatever you use to identify your clients. On your server, the "stats.cgi" script would contain a redirect statement that had YOUR username/password and your clients identifier. Concievably, this would open the urchin report to their specific site without revealing your password.

This is strictly conceptual at the moment but the part about embedding your username/password within the script would work.

Maybe Wullie has some additional thoughts on this?

By the way, to "quote" somebody, place the quote inside of tags. Same for inserting program code -

...some code...

. There's a complete list of TGML tags and what they do at the bottom of the "Reply" section of this page.

There's always a better way. The fun is trying to find it!

 

[AlexandreAmant]

tviman,

I differentiate the users in the url I call to get the stats:

[URL unfurl="true"]http://myserver.com/stats/MyClient1SiteName.com[/URL]

would be the stats for MyClient1.

I've tried this based on your conceptual - but useful - thoughts:

<?php 
header ("Location: [URL unfurl="true"]http://myserver.com/stats/MyClient1SiteName.com");[/URL]
exit;
?>

and it works ok, but I have two problems:
First, I still need to supply username and password and the code

 user:pass@url.com

won't work.
Secondly, it won't interpret the javascript that urchin sends and thus I can't see any stats (all the graphes are in javascript).

 

[Wullie]

Hi mate,

Can you zip a copy of one profile and provide it somewhere for us to access? I might be able to help but cannot really do much without a copy of the code to check with. (Make sure the JS works etc)

Hope this helps

Wullie

http://www.freshlookhosting.com

http://www.tutorial-world.com

http://www.freshlookdesign.co.uk

The pessimist complains about the wind. The optimist expects it to change. The leader adjusts the sails. - John Maxwell

 

[AlexandreAmant]

Hi,

I've found some part of solution here:

http://www.tek-tips.com/viewthread.cfm?SQID=784759&SPID=219&page=1

It is in Perl and prints annoying headers which I don't need, but it works.

I think there is some tuning needed for removing the headers, but I am not good at all in Perl.