Imperative Page View
This article presents a way to require that a site visitor views a certain web page and clicks on a certain link or button before the protected content is displayed in the browser.
The Imperative Page View system is relatively secure. It may not be sufficient for a military installation protecting state secrets. But I don't think it is easily broken.
I'll explain how it works in a moment.
First, here are a few ways the system can be used.
Suppose you had a page that's rather sensitive and you want to make sure everyone reads your disclaimer before they see the sensitive content. The Imperative Page View system can be used to implement that.
Similarly, if terms of service or legalese must be presented and agreed to before a certain page may be viewed, this system can be used.
If you wanted a certain page displayed only when a person clicks on the correct answer of a quiz, this can be used.
Site news, an advertisement, a statement about how many people will go hungry today -- those and other items can be reasons to implement the Imperative Page View system.
How It Works
A few terms: The page the site visitor is required to see is the "required page." The link or button that must be clicked is the "required link." The content to be displayed after the required link is clicked is the "content page."
To work, both JavaScript and cookies must be enabled in the visitor's browser. (If JavaScript is disabled, a NOSCRIPT tag should inform the visitor that JavaScript is required.)
When the required page is loaded in the visitor's browser, a test cookie is set. This test cookie will be retrieved a bit later to confirm that cookies are enabled. If no test cookie can be retrieved, cookies are disabled and a JavaScript alert informs the visitor that cookies are required.
So the required page is loaded and the test cookie set. Now, the required link needs to be clicked in order to see the content page.
When the required link is clicked, the JavaScript sees if the test cookie exists. If the test cookie does exist, the JavaScript redirects the browser to the IPV.cgi script.
The IPV.cgi script verifies that the real cookie (not the test cookie) is available.
If the real cookie is not available, the cookie setting process is being bypassed, whether intentional or not, and the browser is redirected to a URL of your choice (which may be the URL of the required page).
If the real cookie is available, IPV.cgi presents the content page.
The Demonstration and Download Page
See it work at /a/26t/pl.pl?art263
Try to bust it.
If you would like to implement the Imperative Page View system, a download link is at the above URL.
Easy instructions are included in the download package.
Question:
Did you find this article interesting and understandable? How can it be improved?
Your response is anonymous.
When done typing, click anywhere outside the box. [more info]
Will Bontrager
©2004 Bontrager Connection, LLC
Please note:
Articles on this website are presented "as is". However -
If you have a question about a CGI script, HTML, CSS, PHP, or JavaScript
Ask one of our Experts and you'll have your answer!
Click here for details.
