Forum Moderators: open
Within a frameset, this can be relatively easily achieved with a bit of jacascript on each page in the form of
if(self==top) self.location.href = 'index.html';
I am personally not objecting to the use of frames, as I believe that they - if implemented well - allow some nice designs, and most reasons against them do not apply to the sites I am designing. However, since many people seem to object to the use of frames I wonder if the above can be achieved in any other way, be it CSS, javascript or plain html. Does anyone have a suggestion for me?
Of course, if the user blocks ALL cookies then they also can't use you site. But then they could also not allow frames in theory.
You check for the session every page. If there is no session set, redirect them to the login page.
It's the only foolproof method.
You can also have secure directories protected by password. (look up htaccess)
I was wondering if it would be possible via javascript to detect within each of my pages whether the access came from within the domain of my site, i.e. the last displayed page was from my site's domain, and if not redirect to the index page, which than subsequently allows access to the other pages?
My conclusion was that server side script was the only viable option as browsers allow denial of client side scripting and of cookies.
Probably the cleanest option is to detect the referring page (as WolfsonUK mentioned) and if it is external then present the legal stuff. The drawbacks are (1) slight slowing of serving pages as every request is filtered; (2) each visit generates the disclaimer; (3) some M$ servers may require workarounds; (4) as tedster mentioned some browsers don't know where they are coming from. ;-)
On the positive side are (1) no need for login/registration which many people dislike and which adds extra maintenance to the system; (2) every visitor gets the message.
Your server capacity, your traffic volume, and your visitor type are all things to consider to determine which choice is best.
And whichever route you choose you get to learn something - ain't it fun!
Personally I think it's annoying and pointless, but at least the way it's implemented it allows for deep bookmarking and linking. You just click that "I Agree" to the terms and conditions, and it takes you on to wherever you were headed.
iamlost: I agree, lot's to learn and it's fun - once you get around all the obstacles ;-) This is going to be my next task I suppose.
jomaxx: You're right, this is a very good example, it does exactly what I want my sites to do. Don't know however what exactly happens if cookies are disabled, must test this, but not tonight. And as far as we might find it annoying or pointless, I guess we'll have to leave it to the owners of the sites - if they see a valid reason for such disclaimers it's up to us web designers to make them work ;-)
Using the referrer seems to be an approach which can be unsafe too, if some browsers don't know where they are coming from.
txbakers suggestion to create a session seems to be the safe way. However, I don't want visitors having to log in, they shall simple have to click on an 'accept' button for the legal terms. Can a cgi script automatically create a visitor-specific session variable on my index page, that my other pages subsequently check (and if it's not set, they send the visitor to my index page)? Does anyone have an example script for that or can anyone point me in the right direction?
But that session variable would have to be set every time a visitor comes to your site. A session variable by nature goes away when a person closes their browser session.
Maybe a combination of cookies and session variables.
But unless you have some type of event before getting into your site, how is the server to know whether this person should be allowed? A login on each visit is not inconvenient, especially with the browsers that can store form data. Web surfers are used to it. If the content is worth looking at, they will login.
And, if the content is worth protecting this way, you might want to keep an entry log somewhere so you know who is logging in at what time.
Once the visitor leaves the site, next time they return, same procedure again. It would work similar to the Art gallery which was mentioned here before, but without the use of cookies (since if they are disabled, the legal page pops up EACH time you select another page even from within the site, which is a pain).
Any further things such as visitor tracking are not required or wanted at this stage, anyway.
No sweat.
if (String(Request("accept"))!= "undefined") {
Session("Allow") = "true";
}
That's all there is to it.
Then, on every page you want to protect you check for the Session like this:
if (Session("Allow")!= "true") {
Response.Redirect("homepage.asp");
}
That's in ASP with JavaScript.
Your language might be slightly different.
