How To Display A Web Page And Keep Its Location A Secret?

Background: I have a PHP based (Zend Framework) application. It is secure, and only users who have been invited are able to access its resources. One of the resources that I want t

Solution 1:

Perhaps the best way is to let your server actually fetch the page from the other server, then deliver it as content to the browser.

In that way, the external URL is never sent to the browser and therefore it doesn't know anything about it. Instead all the client sees is a URL to your server. Doing it this way would allow you to set whatever security you want on your page.

Pretty much every web language (.Net, PHP, java, etc ) all have support for doing this server side.

UPDATE

Due to the changes to the question, here is a new approach: Use the Google Calendar API. It's built for exactly the situation you are in. It will allow you to display the google calendar within your site as well as manage the access control list via code.

Solution 2:

Why do you want to do this? You really can't completely hide the url of another page, unless you fetch the page and hide it by displaying it on a POSTED form page on your site.

You could try overlaying it in a frame, but the url still could be found.

If you want something simple, to prevent people from causally not bookmarking the url, setup a POSTED link or form that directs to an framed viewer, (embedding the page within another). If anyone bookmarks or shares the page without POSTED data, it can display page not found or access not permitted.

Solution 3:

You could write code that would dynamically generate these URLs and permit them to be accessed only once. That way, users could bookmark them all they wanted to to no avail.

Solution 4:

You could create your own proxy page.

When this page is called, your code will:

• Call the real URL (the one you want to hide).
• Scrape the HTML out of it.
• Remove any references to the hidden URL in that HTML.
• Spit that HTML back to the client.

Also, as per @DanLoewenherz's idea, that page will only work once.

I'm not sure what language/stack your using, but the above is possible in ASP.NET MVC.

Solution 5:

There is no completely secure way to do this without creating your own authenticated proxy server that fetches all of the HTML, JS, CSS, etc., modifies all URLs, and returns them to the user. This is not a simple task.