1

I'd like to restrict access to certain areas of my site (site X) based on whether or not the user has access to certain restricted areas of another site (site Y), which is not under my control.

To be clear, the user not only needs to have valid login credentials to site Y, but their login credentials also need to give them access to a particular page which only certain users can access. Site X doesn't need anything sensitive from this site Y, it just needs to know whether the user's credentials allow them access, before proceeding to show similarly sensitive information on site X. That is to say, being able to access this restricted area of site Y also entitles them to access the sensitive information that I want to show them on site X.

Can I simply prompt the user to login to the restricted area of site Y and know whether or not their login details worked? When trying to access this restricted part of site Y, it's the browser that prompts the user for login as opposed to the site itself. Not sure if that matters or not... Thanks

| improve this question | |
  • "which is not under my control." - Is there no relationship at all between site X and site Y? Site Y is just some arbitrary website? – MrWhite Jun 21 '19 at 15:19
  • You're not supposed to be able to do this sort of cross-origin history hacking any more and if you find you can do it then you should report it to browser makers as a security/privacy bug. In the past people were able to sniff history in various ways, however; some bugs still exist. What's your use case; phishing or something else? If you think about it being able to tell who has membership of other websites is clearly a bad thing: "oh you're a pornhub member, does your wife know? we know ...". – pbhj Jun 22 '19 at 0:25
  • Yes that's correct MrWhite. Thanks for the info pbhj, I think you're right. And thanks everyone else for the answers. My use case is to disseminate research on semi-confidential data so I only wanted to limit it to users who can prove they already have access to the data. Anyhow, I've reached out to the webmaster of site Y to see if they can provide me with some kind of remote authentication service – amin_nejad Jun 24 '19 at 15:39
1

Just an idea. Do you have access to LDAP or similar authentication mechanism? Do both sites use the same LDAP directory? What if you use LDAP via a server side page (PHP, ASP.Net, etc that authenticates the user on SiteY/Page1 before you give them access to SiteX/Page1?

I've used LDAP and other authentication methods in the distant past to customize single sign ons for web applications I managed.

You might have to do some server side magic to make it work. I.e., embed the content of SiteY/Page1 in a hidden frame on SiteX/Page1 using a server side browser API/DLL. If you receive an HTTP 200 response from SiteY/Page1, I think you would have confirmed that they have access to the secondary server.

| improve this answer | |
0

No. There is no way to do this. You would need to gain information from the other site but you have no access to it.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.