Block Page Load if Not Within an Iframe

How to Disallow a Page Loading Not Within an Iframe

[DZur]

Hi there,
DOES ANYONE KNOW HOW TO SUPPRESS A PAGE LOAD IF NOT VIA IFRAME?

As an example I allow a page named:
THE_PAGE_TO_BE_MONITORED.asp to load ONLY IF Set WITHIN AN IFRAME.

OK to load:

<IFRAME SRC="http://www.mysite.com/THE_PAGE_TO_BE_MONITORED.asp"
Name="this page may load" ID=OK>
</iframe>

Disallow/Stop Loading/Send an Alert Message with Warning if
(same page)loaded this way:

<a href="http://www.mysite.com/THE_PAGE_TO_BE_MONITORED.asp">DO SOMETHING TO SUPRESS THIS PAGE LOAD</a>

I am trying this in order to disallow a visitor coming to my website
bypassing the index.htm page.

Thank you very very much and please respond a.s.a.p

[surrealillusions]

You can check the referrers, or maybe create a session or cookie from the index page. If that session or cookie doesn't exist, then redirect them to the index page.

Checking the refferers is usually a bad idea as they can be faked or changed.

hope that helps

:)

[henry0]

You could on index create a session based on:
session name ['does_it_match']
1)$str=$_SERVER['HTTP_USER_AGENT']
2)$str2="WebmasterWorld";// of course could be any str!
3)concat str+str2
4) md5 the result

then on other pages

check if does_it_match isset !empty

etc...

if OK then the user went through the index
If not... redirect..

[tedster]

Note that this same question is also posted in our HTML forum - with other replies. That thread is now locked so that the complete discussion is easy to follow in one place.

[webmasterworld.com...]

[PHP_Chimp]

Seeing as javascript was mentioned on the other thread that is probably not the best way to deal with this.
If your iframe is displayed using javascript then you could use that to stop the iframe getting loaded on its own.
However if your iframe is not loaded with javascript then this is pointless. As a person will turn off javascript and still get your frame, but not your javascript to block showing it on its own.
If your content is shown on other sites then you will also get tools that will allow people to block your javascript (so stopping your script to disalow the content) but to allow the other site (so they get the iframe).
Of course someone could just follow the url for the iframe and get the page anyway if you use javascript to stop it being accessed.

Although it generally relies on the referer you could look into the solutions for avoiding hotlinking to images for .htaccess. Although as it has been pointed out above the referer can be faked.

Some form of $_SESSION variable would probably be your best bet, as mentioned above by henry0 and surrealillusions. As this would stop people viewing the page directly irrespective of javascript being active or not and there is no referer check involved.