Mailing List Archive

On Mon, Jul 11, 2011 at 11:48:09AM -0700, Jerry Pereira wrote:

> I would like to know if there is a way to change the URL displayed on
> browser without using Redirect option. The URL visible on client browser
> must be based on some condition that is evaluated in my mod_perl handler.

Imagine if a web page could cause the browser to display any URL it wanted,
rather than the URL of the page the user is actually viewing... That would
be a huge security hole for spoofing of web sites!

So, why don't you want to do a redirect, exactly?

Ronald

If you are looking to do this for "cosmetic reasons", I do this be simply using frame sets and doing redirects in the child frame. The URL displayed in the location bar will always be constant for the parent frame. I don't think there is any way to do this at the core level or it would be a spoofers windfall. The browser will always have the actual location in the info panel.

From: Jerry Pereira [mailto:online.jerry@gmail.com]
Sent: Monday, July 11, 2011 2:48 PM
To: modperl@perl.apache.org
Subject: Changing browser URL based on condition


Hi All,

I would like to know if there is a way to change the URL displayed on
browser without using Redirect option. The URL visible on client browser
must be based on some condition that is evaluated in my mod_perl handler.

For example -

1. User types the URL - www.example.com<http://www.example.com/>, this will display the login page.
2. Once the user enters the credentials and hits submit, the request is
posted to www.example.com/login<http://www.example.com/login> action.
3. If the credentials entered by the user is valid then i would like to show
the home page..uri
4. I am able to show the homw page, but the URL does not change to
www.example.com/home<http://www.example.com/home>, instead it remains the same (i.e.
www.example.com/login<http://www.example.com/login>). I am using Template toolkit to render my pages. I
tried $req->url('/home'), but that does not change the browser URI.

Any help will be appreciated.

Thanks,
Jerry

From: "Jerry Pereira" <online.jerry@gmail.com>
> Hi All,
>
> I would like to know if there is a way to change the URL displayed on
> browser without using Redirect option.

Nope, not possible.

You need to do that redirection somehow.

What the user sees in the address bar is the URL accessed by the browser. If the browser is not told to access a certain URL, how can that URL appear in the address bar?

Why don't you want to do that redirection?

It is pretty common (and recommended) to do a redirect after POST because in that case the users won't need to meet that ugly warning window that appear if the user does a page refresh after the POST.

Octavian

Hi Edward,

I have the following design:

A single PerlResponseHandler for all requests. This handler based on the
path decides the action to be taken

For example, if the user submits to www.example.com/login, then the handler
delegates the request to authentication module, which will then either
display the home page (throug home page template) or login page again, based
on the success/failure of authentication mechanism. Since i am rendering the
page via template, i am able to generate the content of home page which i
then send back to the client, but the URL on the browser remails the same
(i.e. www.example.com/login), which is not true. Any suggestions to handle
this scenario will be great.

Thanks,
Jerry

On Mon, Jul 11, 2011 at 12:03 PM, Szekeres, Edward <
Edward.Szekeres@perkinelmer.com> wrote:

> If you are looking to do this for “cosmetic reasons”, I do this be simply
> using frame sets and doing redirects in the child frame. The URL displayed
> in the location bar will always be constant for the parent frame. I don’t
> think there is any way to do this at the core level or it would be a
> spoofers windfall. The browser will always have the actual location in the
> info panel.****
>
> ** **
>
> *From:* Jerry Pereira [mailto:online.jerry@gmail.com]
> *Sent:* Monday, July 11, 2011 2:48 PM
> *To:* modperl@perl.apache.org
> *Subject:* Changing browser URL based on condition****
>
> ** **
>
> Hi All,****
>
> I would like to know if there is a way to change the URL displayed on
> browser without using Redirect option. The URL visible on client browser
> must be based on some condition that is evaluated in my mod_perl handler.*
> ***
>
> For example -****
>
> 1. User types the URL - www.example.com, this will display the login page.
> 2. Once the user enters the credentials and hits submit, the request is
> posted to www.example.com/login action.
> 3. If the credentials entered by the user is valid then i would like to
> show
> the home page..uri
> 4. I am able to show the homw page, but the URL does not change to
> www.example.com/home, instead it remains the same (i.e.
> www.example.com/login). I am using Template toolkit to render my pages. I
> tried $req->url('/home'), but that does not change the browser URI.****
>
> Any help will be appreciated.****
>
>
> Thanks,
> Jerry****
>



--
Your clothes may be the latest in style but you aint completely dressed
until you wear a smile!
Keep smiling : )

On 07/11/2011 03:14 PM, Jerry Pereira wrote:
> Any suggestions to handle this scenario will be great.

As others have noted, there isn't a way to do this. If it's a
requirement of your application then the only way to handle it is to do
redirection. And as others have pointed out it's a good idea to do a
redirect after a POST anyway since it prevents other problems.

--
Michael Peters
Plus Three, LP

Much better to go with a more RESTful approach - the URL is the identifier
for the page and you don't want that identifier to represent the wrong page,
e.g. if example.com/login sometimes returns the home page and sometimes
returns some other page (assuming you can login from and return to multiple
pages.)

Make it so that your home page (or any page) have a login form (or link
which expands to a login form) which POSTs to the login page (or to think of
it in a RESTful way, PUT to a "sessions" URL, thus defining the idea of
"create a new session" - except that browser forms have problems with PUT).
Then from the login page do a redirect to whatever was the referer.



On Mon, Jul 11, 2011 at 12:14 PM, Jerry Pereira <online.jerry@gmail.com>wrote:

> Hi Edward,
>
> I have the following design:
>
> A single PerlResponseHandler for all requests. This handler based on the
> path decides the action to be taken
>
> For example, if the user submits to www.example.com/login, then the
> handler delegates the request to authentication module, which will then
> either display the home page (throug home page template) or login page
> again, based on the success/failure of authentication mechanism. Since i am
> rendering the page via template, i am able to generate the content of home
> page which i then send back to the client, but the URL on the browser
> remails the same (i.e. www.example.com/login), which is not true. Any
> suggestions to handle this scenario will be great.
>
> Thanks,
> Jerry
>
> On Mon, Jul 11, 2011 at 12:03 PM, Szekeres, Edward <
> Edward.Szekeres@perkinelmer.com> wrote:
>
>> If you are looking to do this for “cosmetic reasons”, I do this be
>> simply using frame sets and doing redirects in the child frame. The URL
>> displayed in the location bar will always be constant for the parent frame.
>> I don’t think there is any way to do this at the core level or it would be a
>> spoofers windfall. The browser will always have the actual location in the
>> info panel.****
>>
>> ** **
>>
>> *From:* Jerry Pereira [mailto:online.jerry@gmail.com]
>> *Sent:* Monday, July 11, 2011 2:48 PM
>> *To:* modperl@perl.apache.org
>> *Subject:* Changing browser URL based on condition****
>>
>> ** **
>>
>> Hi All,****
>>
>> I would like to know if there is a way to change the URL displayed on
>> browser without using Redirect option. The URL visible on client browser
>> must be based on some condition that is evaluated in my mod_perl handler.
>> ****
>>
>> For example -****
>>
>> 1. User types the URL - www.example.com, this will display the login
>> page.
>> 2. Once the user enters the credentials and hits submit, the request is
>> posted to www.example.com/login action.
>> 3. If the credentials entered by the user is valid then i would like to
>> show
>> the home page..uri
>> 4. I am able to show the homw page, but the URL does not change to
>> www.example.com/home, instead it remains the same (i.e.
>> www.example.com/login). I am using Template toolkit to render my pages. I
>> tried $req->url('/home'), but that does not change the browser URI.****
>>
>> Any help will be appreciated.****
>>
>>
>> Thanks,
>> Jerry****
>>
>
>
>
> --
> Your clothes may be the latest in style but you aint completely dressed
> until you wear a smile!
> Keep smiling : )
>

From: "Jerry Pereira" <online.jerry@gmail.com>

Hi Edward,

I have the following design:

A single PerlResponseHandler for all requests. This handler based on the
path decides the action to be taken

For example, if the user submits to www.example.com/login, then the handler
delegates the request to authentication module, which will then either
display the home page (throug home page template) or login page again, based
on the success/failure of authentication mechanism.



Instead of displaying those pages, why can't the authentication module do a redirect to the handler that display the wanted page?


Octavian

On Mon, 11 Jul 2011 11:48:09 -0700
Jerry Pereira <online.jerry@gmail.com> wrote:
> 1. User types the URL - www.example.com, this will display the login
> page.
> 2. Once the user enters the credentials and hits submit, the request
> is posted to www.example.com/login action.
> 3. If the credentials entered by the user is valid then i would like
> to show the home page..uri
> 4. I am able to show the homw page, but the URL does not change to
> www.example.com/home, instead it remains the same (i.e.
> www.example.com/login).

One important reason to do something like that is because you do not
want the user to bookmark or otherwise pass on an url with completely
ambiguous content -- /login should refer to the login page, /home should
refer to the home page, they are two different things. Having /login
refer to both is no good. So I think your desire is justified.

IMO, this is best handled client-side: you return your login data via
an AJAX call. If the login succeeds, the client loads /home. If the
login has failed, the client displays a message to that effect. You
need to prevent spoofed access to /home, but of course you have to do
that anyway (via cookies or whatever method you are already using).

--
"Enthusiasm is not the enemy of the intellect." (said of Irving Howe)
"The angel of history[...]is turned toward the past." (Walter Benjamin)

Agree with the consensus. The URI should be descriptive of the
function, so any requests to /login should be from users who are
attempting to... login. The home page should be housed under a separate
URL (/home for example)

After the user has authenticated, the login module should redirect to
the /home URI. Any links to the home page from within the application
should likewise refer to /home. You should have security in place to
redirect any unauthenticated users to /login before requests for /home
(or any other part of your application) are processed.

If you for some reason simply MUST keep referring people to /login when
they are expecting to see the home page, put code in your login module
to check for authenticated users and redirect them to /home before
displaying the login page. If the user doesn't have a session, then go
ahead and display the login form.


On 11-07-11 03:14 PM, Jerry Pereira wrote:
> Hi Edward,
> I have the following design:
> A single PerlResponseHandler for all requests. This handler based on
> the path decides the action to be taken
> For example, if the user submits to www.example.com/login
> <http://www.example.com/login>, then the handler delegates the request
> to authentication module, which will then either display the home page
> (throug home page template) or login page again, based on the
> success/failure of authentication mechanism. Since i am rendering the
> page via template, i am able to generate the content of home page
> which i then send back to the client, but the URL on the browser
> remails the same (i.e. www.example.com/login
> <http://www.example.com/login>), which is not true. Any suggestions to
> handle this scenario will be great.
> Thanks,
> Jerry
>
> On Mon, Jul 11, 2011 at 12:03 PM, Szekeres, Edward
> <Edward.Szekeres@perkinelmer.com
> <mailto:Edward.Szekeres@perkinelmer.com>> wrote:
>
> If you are looking to do this for “cosmetic reasons”, I do this be
> simply using frame sets and doing redirects in the child frame.
> The URL displayed in the location bar will always be constant for
> the parent frame. I don’t think there is any way to do this at
> the core level or it would be a spoofers windfall. The browser
> will always have the actual location in the info panel.
>
> *From:*Jerry Pereira [mailto:online.jerry@gmail.com
> <mailto:online.jerry@gmail.com>]
> *Sent:* Monday, July 11, 2011 2:48 PM
> *To:* modperl@perl.apache.org <mailto:modperl@perl.apache.org>
> *Subject:* Changing browser URL based on condition
>
> Hi All,
>
> I would like to know if there is a way to change the URL displayed on
> browser without using Redirect option. The URL visible on client
> browser
> must be based on some condition that is evaluated in my mod_perl
> handler.
>
> For example -
>
> 1. User types the URL - www.example.com <http://www.example.com/>,
> this will display the login page.
> 2. Once the user enters the credentials and hits submit, the
> request is
> posted to www.example.com/login <http://www.example.com/login> action.
> 3. If the credentials entered by the user is valid then i would
> like to show
> the home page..uri
> 4. I am able to show the homw page, but the URL does not change to
> www.example.com/home <http://www.example.com/home>, instead it
> remains the same (i.e.
> www.example.com/login <http://www.example.com/login>). I am using
> Template toolkit to render my pages. I
> tried $req->url('/home'), but that does not change the browser URI.
>
> Any help will be appreciated.
>
>
> Thanks,
> Jerry
>
>
>
>
> --
> Your clothes may be the latest in style but you aint completely
> dressed until you wear a smile!
> Keep smiling : )

It seems to be just an attempt to do what is already done in Apache2::AuthCookie (CPAN), which encapsulates a server side authentication.


-----Original Message-----
From: MK [mailto:mk@cognitivedissonance.ca]
Sent: Monday, July 11, 2011 3:37 PM
To: modperl@perl.apache.org
Subject: Re: Changing browser URL based on condition

On Mon, 11 Jul 2011 11:48:09 -0700
Jerry Pereira <online.jerry@gmail.com> wrote:
> 1. User types the URL - www.example.com, this will display the login
> page.
> 2. Once the user enters the credentials and hits submit, the request
> is posted to www.example.com/login action.
> 3. If the credentials entered by the user is valid then i would like
> to show the home page..uri
> 4. I am able to show the homw page, but the URL does not change to
> www.example.com/home, instead it remains the same (i.e.
> www.example.com/login).

One important reason to do something like that is because you do not
want the user to bookmark or otherwise pass on an url with completely
ambiguous content -- /login should refer to the login page, /home should
refer to the home page, they are two different things. Having /login
refer to both is no good. So I think your desire is justified.

IMO, this is best handled client-side: you return your login data via
an AJAX call. If the login succeeds, the client loads /home. If the
login has failed, the client displays a message to that effect. You
need to prevent spoofed access to /home, but of course you have to do
that anyway (via cookies or whatever method you are already using).

--
"Enthusiasm is not the enemy of the intellect." (said of Irving Howe)
"The angel of history[...]is turned toward the past." (Walter Benjamin)

Szekeres, Edward wrote:
> It seems to be just an attempt to do what is already done in Apache2::AuthCookie (CPAN), which encapsulates a server side authentication.
>
>
+1
Exactly.
And I would add that before you start trying to implement you own authentication logic,
you should really think twice. HTTP authentication is a lot more messy than what you
would at first think, and you should first have a look at some existing CPAN modules like
the one mentioned above, and browse the code to understand what they are doing and why. Or
just use them, they work.


Just one aspect : if the URL from which the browser "thinks" the current page is coming,
is not the one from which the page is really coming, then it also means that any
/relative/ link inside your pages is not going to work as you expect it to.

Thanks Guys!!! I will go ahead with Redirect approach. I was more interested
in building a generic framework for my application that would handle such
scenarios (login was just one of them).

On Mon, Jul 11, 2011 at 12:42 PM, Szekeres, Edward <
Edward.Szekeres@perkinelmer.com> wrote:

> It seems to be just an attempt to do what is already done in
> Apache2::AuthCookie (CPAN), which encapsulates a server side authentication.
>
>
> -----Original Message-----
> From: MK [mailto:mk@cognitivedissonance.ca]
> Sent: Monday, July 11, 2011 3:37 PM
> To: modperl@perl.apache.org
> Subject: Re: Changing browser URL based on condition
>
> On Mon, 11 Jul 2011 11:48:09 -0700
> Jerry Pereira <online.jerry@gmail.com> wrote:
> > 1. User types the URL - www.example.com, this will display the login
> > page.
> > 2. Once the user enters the credentials and hits submit, the request
> > is posted to www.example.com/login action.
> > 3. If the credentials entered by the user is valid then i would like
> > to show the home page..uri
> > 4. I am able to show the homw page, but the URL does not change to
> > www.example.com/home, instead it remains the same (i.e.
> > www.example.com/login).
>
> One important reason to do something like that is because you do not
> want the user to bookmark or otherwise pass on an url with completely
> ambiguous content -- /login should refer to the login page, /home should
> refer to the home page, they are two different things. Having /login
> refer to both is no good. So I think your desire is justified.
>
> IMO, this is best handled client-side: you return your login data via
> an AJAX call. If the login succeeds, the client loads /home. If the
> login has failed, the client displays a message to that effect. You
> need to prevent spoofed access to /home, but of course you have to do
> that anyway (via cookies or whatever method you are already using).
>
> --
> "Enthusiasm is not the enemy of the intellect." (said of Irving Howe)
> "The angel of history[...]is turned toward the past." (Walter Benjamin)
>
>


--
Your clothes may be the latest in style but you aint completely dressed
until you wear a smile!
Keep smiling : )

I think you need to do a redirect. From within your mod_perl handler try something like this:

$r->content_type("text/plain");

$r->headers_out->set(Location=>$url);

return Apache2::Const::HTTP_TEMPORARY_REDIRECT;


From: Jerry Pereira [mailto:online.jerry@gmail.com]
Sent: Monday, July 11, 2011 2:48 PM
To: modperl@perl.apache.org
Subject: Changing browser URL based on condition


Hi All,

I would like to know if there is a way to change the URL displayed on
browser without using Redirect option. The URL visible on client browser
must be based on some condition that is evaluated in my mod_perl handler.

For example -

1. User types the URL - www.example.com<http://www.example.com/>, this will display the login page.
2. Once the user enters the credentials and hits submit, the request is
posted to www.example.com/login<http://www.example.com/login> action.
3. If the credentials entered by the user is valid then i would like to show
the home page..uri
4. I am able to show the homw page, but the URL does not change to
www.example.com/home<http://www.example.com/home>, instead it remains the same (i.e.
www.example.com/login<http://www.example.com/login>). I am using Template toolkit to render my pages. I
tried $req->url('/home'), but that does not change the browser URI.

Any help will be appreciated.

Thanks,
Jerry

IMPORTANT NOTICE REGARDING THIS ELECTRONIC MESSAGE:

This message is intended for the use of the person to whom it is addressed and may contain information that is privileged, confidential, and protected from disclosure under applicable law. If you are not the intended recipient, your use of this message for any purpose is strictly prohibited. If you have received this communication in error, please delete the message and notify the sender so that we may correct our records.

From: Jerry Pereira

Thanks Guys!!! I will go ahead with Redirect approach. I was more interested in building a generic framework for my application that would handle such scenarios (login was just one of them).



Then, as somebody suggested, start using Catalyst framework. It will handle the authentication/authorization very easy, and you will be able to continue to use your app with mod_perl if you want that.
And of course, you will have many other good features in it.

Octavian

2011-07-11 20:48, Jerry Pereira wrote:
> Hi All,
>
> I would like to know if there is a way to change the URL displayed on
> browser without using Redirect option. The URL visible on client browser
> must be based on some condition that is evaluated in my mod_perl handler.
>
> For example -
>
> 1. User types the URL - www.example.com <http://www.example.com/>, this will display the login page.
> 2. Once the user enters the credentials and hits submit, the request is
> posted to www.example.com/login <http://www.example.com/login> action.
> 3. If the credentials entered by the user is valid then i would like to show
> the home page..uri
> 4. I am able to show the homw page, but the URL does not change to
> www.example.com/home <http://www.example.com/home>, instead it remains the same (i.e.
> www.example.com/login <http://www.example.com/login>). I am using Template toolkit to render my pages. I
> tried $req->url('/home'), but that does not change the browser URI.
>
> Any help will be appreciated.

Telling the browser to fudge the URL is a client side thing. There is support for this in HTML5, with varying support in different browsers.

One starting point could be this:
http://stackoverflow.com/questions/4015613/good-tutorial-for-using-html5-history-api-pushstate


--
Mårten Svantesson
Senior Developer
Travelocity Nordic
+46 (0)8 505 787 23

[sNip]
> Telling the browser to fudge the URL is a client side thing. There is support for this in HTML5, with varying support in different browsers.
[sNip]

I really hope the hostname portion is excluded from this; if not,
then the world will be hit by a whole new set of scams. =(

Do you happen to know if the HTML5 standards limit this?

Randolf Richardson - randolf@inter-corporate.com
Inter-Corporate Computer & Network Services, Inc.
Vancouver, British Columbia, Canada
http://www.inter-corporate.com