Sessions, iFrames and maybe more

[Steve Workings]

I have a URL I need to post to get the user logged into an API.

The problem is that the "standard" method of doing for this API is to actually redirect the user to the API's pages. I don't want to do that -- I want to log into the API, and have the user stay right on my page.

I've tried what I can think of, and there's probably more than one way. One way would be:

Call the URL as part of a page in an iframe. The problem with this is that the page in the iFrame isn't aware of the session variables of the logged-in user, which I need. Is there a way to make the session variables available to the page in the iframe?

Another way is to use http_post(), and call that programatically. That works because I can pass in the user information from the session, and it does succeed with the login. But, it does not (and I don't want it to) redirect the current client browser, so the browser never gets the cookie from the API service, and the login is useless without the cookie. Tech support at the service tells me the login is good, but also says the browser needs to be aware that it has "visited" the site.

So, any suggestions?

[Steve Wood]

Re: Sessions, iFrames and maybe more

Try this - your IFrame has as URL that points to their page. Just include your variables in the URL as parameters exactly as you did for your http_post operation. Your browser will have "visited" that other page.

[Steve Workings]

Re: Sessions, iFrames and maybe more

Can't figure out how to do this Steve.

Currently, I'm sending:

http_post(sUrl)

FYI, the current URL ends with an encrypted JSON Web Token parameter:

https://...?jwt=" + sParameter

So, before the post, I've now tried:

sString = "&session.username=" + session.username + "&session.userid=" + session.userID
sUrl = sURL + sString

The session.Username and session.userID are also the logins for the API, though of course the API makes no use of them here. And, it may even be failing at the API end - I don't know without bugging tech support again.

Did you have something in mind other than this?

[Steve Wood]

Re: Sessions, iFrames and maybe more

I had to test because I did not know how session vars would behave in an IFrame. So if I run an IFrame from the parent like this:

<iframe src="http://www.alphatogo.com/sampletest.a5w?id=100"></iframe>

And then sampletest.a5w has this:

<%A5
session.id = id
?a5w_info()
%>

The CHILD knows session.id's value provided in the IFrame URL. But the parent knows nothing of it.

You cannot pass session.id=myvalue in the URL, it will create a variable named "session.id" not a session variable.

All the API's I have used send something back, and what they send back is enough to do whatever it is supposed to do. That would be using http_post or http_fetch(). From what I read, if you try to redirect the IFrame back to the parent (e.g., "visit" the API page, then redirect back to your page, using Javascript, again from what I read), you will cause a "cross-browser scripting error".

[Steve Workings]

Re: Sessions, iFrames and maybe more

Thanks Steve. Yeah, I've asked this (well known) provider of the API if they might allow me to pass around some identifier, but I'm amazed to find out they hadn't thought of that. There's gotta be some way to do this...