|
| |
|
|
pcguy
Posts: 125
From: None
Status: offline
 |
A different URL for each customer? - 6/28/2006 8:37:48
Hi,
I've seen this done a while ago, and only recently need to do it myself...(I'm using ASP)
I want to be able to give my customers a unique URL which would say, contain their order number...like:
www.mysite.com/ORDER23334
The site would then grab the "ORDER23334" to see if it's valid, and go from there...
I DO NOT want to use this format:
www.mysite.com/order.asp?id=ORDER23334
because then each customer is using the same URL essentially, and I don't want that URL to "get out", since it is a private area of the site.
Does anyone know how this can be done? Or some close to it? Any suggestions?
Thanks
|
|
|
|
ou812
Posts: 1612
Joined: 1/5/2002
From: San Diego
Status: offline
|
RE: A different URL for each customer? - 6/28/2006 10:44:18
I think I would still go with the "www.mysite.com/order.asp?id=ORDER23334" idea. And since you don't want people going to this URL unless they have an order I would first do a check in ASP to see if it's a valid order number to display this custom page or not. If not, redirect them, if so, build your page as needed. So, the URL can "get out" but no one can view or use it unless there's a valid order number. One page, for me, makes it much easier for updating/modifications and keeping things simple. </$.02>
_____________________________
-brian
EnterpriseDB: Enterprise-class relational database management system
PostgreSQL: The world's most advanced open source database
| |
|
|
|
yb2
Posts: 653
Joined: 1/30/2006
Status: offline
|
RE: A different URL for each customer? - 7/14/2006 12:45:58
quote:
If you want it secure then you'll need to set up a login for each customer and then the results of that login take them to that page.
quote:
One page, for me, makes it much easier for updating/modifications and keeping things simple.
Good advice.
Along with a login, you'd need to check authorisation everytime a request was made for the form by checking the username against a table of order numbers to make sure they could have access to them. Otherwise those who could login could look at anyone else's orders.
Personally, I'd also use POST instead of GET, and have a page that showed all of your orders as links/buttons that you click to see them, with latest on top. POST is much more tamper proof, and it's only one click more. Then they'd only have to remember one link ever.
_____________________________
it is natural for people not to see one's own faults, and to exaggerate other people's faults and failings.
Currently listening to: L'Enfer Des Formes by Stereolab
| |
|
|
|
rdouglass
Posts: 9280
From: Biddeford, ME USA
Status: offline
|
RE: A different URL for each customer? - 7/14/2006 13:46:44
quote:
POST is much more tamper proof
Just a little OT curiosity as to how you came to that conclusion? People don't see it in their browser so they don't think about it?
_____________________________
Don't take you're eye off your final destination.
ASP Checkbox Function Tutorial.
| |
|
|
|
yb2
Posts: 653
Joined: 1/30/2006
Status: offline
|
RE: A different URL for each customer? - 7/14/2006 14:14:39
that's the main one, also the amount of people that would know how to submit a tampered POST is many times smaller than the amount of people who know how to change a querystring in their address field. (I'm using the MS vs Linux security argument - MS gets hit more because it's better known:)
POST info is also encrypted automatically when using https, but not the querystring, so better in that situ too.
from this http://www.w3.org/2001/tag/doc/get7
quote:
If you use GET for operations with side-effects, your make your system insecure.
GET is for getting information, POST is for doing things like database changes or emailing. As a rule of thumb it's very good IMO, except for secure info where a querystring is like an open invitation to tampering.
btw, what does OT mean?
_____________________________
it is natural for people not to see one's own faults, and to exaggerate other people's faults and failings.
Currently listening to: L'Enfer Des Formes by Stereolab
| |
|
|
|
rdouglass
Posts: 9280
From: Biddeford, ME USA
Status: offline
|
RE: A different URL for each customer? - 7/14/2006 14:23:16
quote:
what does OT mean?
Off Topic.
...and I think this is the important piece:
quote:
In particular, the convention has been established that the GET and HEAD methods SHOULD NOT have the significance of taking an action other than retrieval.
_____________________________
Don't take you're eye off your final destination.
ASP Checkbox Function Tutorial.
| |
|
 New Messages |
 No New Messages |
 Hot Topic w/ New Messages |
 Hot Topic w/o New Messages |
 Locked w/ New Messages |
 Locked w/o New Messages |
|
Post New Thread
Reply to Message
Post New Poll
Submit Vote
Delete My Own Post
Delete My Own Thread
Rate Posts
|
|
|
Printable Version 
