3

I have a SaaS application that offers some basic white-labelling functionality related to CSS, company logos etc. However, one client now wants to white-label the application with their own URL so that they can then resell it to their own customers.

The way that they have chosen to implement this is by having a single page on their own webserver that uses HTML 4 frames (not iframes) to host our site. This works fine for Chrome, Firefox, Safari and newer versions of IE, but breaks badly for older versions of IE (particularly IE8) when running in a locked-down corporate environment. This is because the entire application requires user authentication, which in our environment (IIS/ASP.NET) means the use of cookies; and with sites that have not been explicitly trusted by locked-down IE8, the cookie domain not matching the browser's URL causes the cookie to be rejected, so users can not sign in to our application.

We can also be sure that asking clients of our clients to change their security policies so that they can access our application is also a non-starter, as is asking them to switch to another browser!

Does anyone have experience of running secure white-labelled sites in this or similar ways? Short of setting up separate webservers with new URLs and SSL certificates, with ASP.NET's cookieless session tracking enabled, I'm not sure what else I can try.

Improve this question
4
  • I hope this is a lesson learned about choosing a web development environment wisely.
    – Rob
    Commented May 9, 2016 at 12:33
  • I'm not sure I follow; the issue is primarily around older Microsoft browsers and their security model. What does choice of development environment have to do with it?
    – David Keaveny
    Commented May 10, 2016 at 0:20
  • A locked down corporate environment that uses older IE browsers means one that is targeted at Microsoft products and not web standards. Specifically, Microsoft products are non-native and hostile to the web beginning with which way the slashes go. Therefore, development environment choice was poor at the start and you are paying the price now. A lesson I learned at my web beginnings in 2003.
    – Rob
    Commented May 10, 2016 at 2:55
  • Unfortunately that's what our customers use; they'll be serving up IE8 running on Server 2008 via Citrix Winframe. Our software never shipped with a "Works Best In IE" logo :-) it's more the diktats of the IT departments of our corporate customers. Supporting it is a real pain in the neck, but it's one of the realities of building software for corporates.
    – David Keaveny
    Commented May 10, 2016 at 4:18

1 Answer 1

Reset to default
1

I have done this in the past and the best way I have found to overcome this has been setting up the application (which for us was a white label customer support portal) on it's own instance of apache configured to handle all traffic from all domains on a particular IP address...

EG: www.domain.com, portal.domain-2.com, portal.domain-3.co.cc ...

We then programmed into the application detection of the domain name and the business logic handled branding of the site with a custom css file for colours and key images such as logo's and yet still functioned the way we needed it to. In addition we where using a few cookies, not for authentication but still for required application functionality, and because the domain name was handled all the way through from the browser to the application server setting cookies was no problem as it was all in the correct domain based on the white label domain being used.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.