0

I would like to import data that the user had entered into his profile on a website that I do not control. I don't want the user to hand me his login credentials to grab the data from the server-side (connecting directly to aforementioned website). I would rather prefer the login data to stay on the client's machine: It makes my service more trustworthy and I don't have to process sensitive data.

I thought that this can probably done with javascript without greater hassle. However, given the security risks, it seems to be blocked by browsers. See How to get data with JavaScript from another server?

So I think my question is already answered and can be closed/deleted.

Community
  • 1
  • 1
ypnos
  • 50,202
  • 14
  • 95
  • 141
  • possible duplicate of [How to get data with JavaScript from another server?](http://stackoverflow.com/questions/578095/how-to-get-data-with-javascript-from-another-server) – ypnos Sep 22 '11 at 15:56

2 Answers2

1

I'm not sure I understand what you're trying to do, but there is no secure way to verify login credentials in a browser client. If you want to check login credentials, you will have to involve a server.

Some data can be stored on the client side, but then a user is tied to a particular browser on a particular computer and can't use the service from anywhere else. In older browsers data is generally limited to what can be stored in a cookie and cookies are not guaranteed to survive for any particular long lasting time frame. In the latest browsers, data can be stored in HTML5 local storage which allows for a little more structured way of storing data, but even then you're still stuck in one particular browser on one particular computer.

Based on your comments, it sounds you're trying to "cache" a copy of the data from web-site A that you can access from client-side code on web-site B on multiple visits to your website. If that's the case, then it sounds like HTML5 local storage may work to serve as a cache storage mechanism. You will have to figure out how to get the data from web-site A into the cache as the cache will be subject to same-origin access (domain X can only access the data that was put into HTML5 local storage by domain X), but if you can get manage to get the data from web-site A into your web-site B client-side page (perhaps using JSONP), then you could cache it using HTML5 local storage. You will need to realize that even HTML5 local storage is not guaranteed forever (so you need to be able to fetch it again from web-site A if required).

Bill the Lizard
  • 398,270
  • 210
  • 566
  • 880
jfriend00
  • 683,504
  • 96
  • 985
  • 979
  • There is website A where the user may login. I don't own website A. I own website B and want the data that is available on A, but only visible to the user. So the user can login there and A will check her credentials, then the data is available to the user and could be send to me (B). – ypnos Sep 22 '11 at 15:25
  • I added more comments to my answer based on your clarification. – jfriend00 Sep 22 '11 at 16:02
  • Thank you. I guess I don't find a way to access the local storage from the other domain.. – ypnos Sep 22 '11 at 16:21
  • Nope. Local storage is like cookies. It's only accessible from the domain that wrote it. – jfriend00 Sep 22 '11 at 16:33
1

You said this

I don't want the user to hand me his login credentials to grab the data from the server-side (connecting directly to aforementioned website).

If you do that, anyone would be able to access any User's data, since you don't restrict access to data.

You also said this

I would rather prefer the login data to stay on the client's machine: It makes my service more trustworthy and I don't have to process sensitive data.

I'm really not sure that's a good idea. You still need to lock down personal information. But anyway, if you really want to, you can use localstorage -- modern webbrowsers support this.

Check out this link for a primer on local storage. Storing Objects in HTML5 localStorage

Note that the user can clear the browsers local storage, so you still need to have a form to enter credentials.

EDIT -- if you want to save a user's profile information on the client, you can do that with local storage. But you still need to save the data to the server, else if the user goes to a different machine or even browser, they won't have their data. Plus, your server side model probably needs to associate a user's content with their profile in some way. I don't think there is any way around it.

Community
  • 1
  • 1
hvgotcodes
  • 118,147
  • 33
  • 203
  • 236