I want to create a document and video library, and there are some conflicting constraints:

  • we want to keep the maintenance and updating of the library separate from the team that manages the main website; as we have everything on a Google drive, it seems easiest to create a Google Site as the portal for the entire library (it will not be huge, like one page of PDFs, and a few with videos).
  • we want password protection, without using the Google drive access rights management (very inconvenient for visitors/users without Gmail accounts). It does not need to be super strong protection, but we just want to avoid that it is widely accessible
  • we want to distribute the link to the library (to interested members), but this link should point to somewhere on our overall website (example.org), and we do not want users to be able to copy the link to the Google Site (hence be able to send that link to others, who then of course can bypass the access control).

I tried a few options, but none is fully satisfactory:

  • I created a example.org/library sub directory (which is the link that then can be shared), and password protected this with .htaccess; then the page redirects (simple html meta refresh) to the Google Site. Problem = users can just copy the Google Site URL and send to others.
  • I created a subdomain (library.example.org), and with DNS CNAME redirect, this points to the Google Sites. This is a much cleaner URL, but the problem is similar. Once you have that URL, you can share that one, and there is no password protection anymore.

I was thinking about some other solutions, but I want to understand whether these are feasible (will solve the problem), or is there another option that I overlooked?

  1. use JS to open a new window without address bar. Looks good in theory, but does it work on mobile? and will the browser settings not override this, and just open it in new tab, with address bar visible?
  2. use rewrite rule to map the Google Site to a example.org subfolder. I played a bit with rewrites within the same domain, but never used to point to a domain that I do not control (the Google Site)
  3. iFrame is not possible for Google Sites, but would it work with the subdomain fronting the Google Sites pages?
  4. could I implement a reverse proxy? I am on a LAMP stack, and I can use mod-proxy, but not sure whether this can be done with Google Site?
  • I tried 3. (iframe), but it gives blank page. Analyzing headers of library.example.org there is a x-frame-options: SAMEORIGIN . As the iFrame is on example.org/library, and in the iFrame I put library.example.org, I hoped that this would count as SAMEORIGIN, but obviously it doesn't. Maybe logical as the server is a Google server who does not see the associated domain.
    – Peter K.
    Dec 9, 2021 at 12:22
  • Even if you got the IFRAME to "work" this still exposes the public (unrestricted) URL to anyone who looks at the HTML source or network traffic. The same with #1 (JavaScript popup). You can't rewrite the URL across domains (#2) - this is when you need to configure a reverse proxy, ie. #4. I would have the reverse proxy is the only way to configure this if you are intent on using Google Sites. (Although if the Google Site address is ever discovered then your security is bypassed.) Or implement this on your own site using Google Drive API?
    – MrWhite
    Dec 9, 2021 at 12:54
  • @MrWhite Thanks for your insights, I see what you mean. Ok, it seems I'll have to learn setting up a reverse proxy ... Implementing it on the site itself with Google Drive API would put the workload for updating/managing the "library" portal on the comms team (who also manage the website), while the idea is to separate it. Just implement the set-up once, and then another project team can work on the Google Sites, while it remains transparent for the visitor. It's for a volunteer-run organization, so resources are scarce.
    – Peter K.
    Dec 9, 2021 at 15:01
  • @MrWhite Maybe you can add your comment as answer, so I can accept and we close this off? I am working on the mod_proxy, but for the moment no success. I'll have to post another question. Not sure though whether it's better here or in serverfault or in SO...
    – Peter K.
    Dec 10, 2021 at 10:44


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.