Hi,
The scenario is as follows. I have developed some asp.net webforms (in c#), some of them with extensive data base access and processing. I would like to use these webforms as (a kind of) modules within my own DNN site.

I have looked at using the DNN IFrame module for this. It works, I can parse the dnn user id to my webform and use that when I want to access my own user-related data.

So far, so good.

Except that, a user can look into the source of the dnn page (containing the IFrame module) and see how my webform is called with an url with  the userid prameter. It is of course irresistable for plenty people to try this url on their own with all kind of variations of userid. A big security leak.

I have looked at two options to prevent this from happening (a) request referrer and (b).htaccess

(a) request referrer -- This works alright but I am told that it is rather simple to fake the referring url. Conclusion: this is not good enough to prevent hackers.

(b) .htaccess -- Within .htaccess I can deny calls from other domains than my own website. But it doesn't prevent (as far as I could test) a user from pasting the url with userid in the browser. Conclusion: this is not good enough to prevent hackers.


A third option would be to change the IFrame software to enable a kind of  'secret handshake'.

The IFrame generates a strong codestring and places it in the url and also in the dnn database. It also provides some sql code to retrieve this codestring from the database so that it can be compared with the string in the url.

Something like that or any better solution.

If it would work, IFrame would be used so much more by all those people who have their own webform pages and want these used within the dnn framework without using the complete module development process that is available from dnn.