CFHTTP and secure sites

[Gakusei]

OK, I've used the CFHTTP tag with the URL, method, ResolveURL, UserName, and
Password parameters to connect to a remote server that requires authentication.
But here's the problem:

Although the page's source is retrieved without a problem, when the browser
attempts to render the returned source code, the browser gets stopped for a
login prompt at EVERY dependent file (images, stylesheets, even BASE HREF
tags)... I thought the whole idea of the username and password parameters was
to allow us to see and use a site requiring authentication, but it seems to me
that it works only on the original source code and not the dependencies... am I
missing something here?

Any help would be very much appreciated!

Thanks in advance,

bw

[ssawka]

You need to think about how CFHTTP works. Essentially when you use CFHTTP, the
Cold Fusion server is mimicking the actions of your browser to retrieve the
page. When you log into a "secure" site, you enter in a User Id and a
Password. The remote site authenticates you and stores a token (cookie, etc.)
in your browser so the site can maintain a "session" with your browser, and
know that you have already "logged in". When you send the User Id and Password
via CFHTTP, the token is sent back to the ColdFusion server, not your browser.
However, when a link or object (image, style sheet, script, etc.) is embedded
within the code retrieved via CFHTTP, and you simply display that code "as is",
your browser is requesting the embedded objects. Hence your browser needs to
be "authenticated" not the CF Server. This is analogist to adding an item to
a shopping cart using IE, but then trying to check out using FireFox.

Hope this helps,
Sean

[jdeline]

ssawka, would it make sense to parse CFHTTP.FILECONTENT, make a list of all
..jpg, .gif, .css, etc. and have the ColdFusion server get them. It would seem
that, since the CF server has the cookie, it would be authorized to do that.
There would be a small issue as to what to do with these files after the server
gets them, but that can be worked out so the page can render properly.

[ssawka]

Sorry, I did not see your second post until today. Yes having ColdFusion
download the files is one method, however the links may need to be modified as
well. There may be other methods depending on how the session is being
maintaines by the third party site.