After a security review of an internal site, a concern was raised that passing parameters to other pages in cleartext where the parameter name was rather reveling was weak from a security point of view.  The pages where the concern was raised all used DotNetNuke’s IFrame module, and in fact the parameters were passed in cleartext.  For example, several of the target Frames required that the user’s username be passed.  The IFrame module would create a URL like www.othersite.com?username=myusername. This meant that a user could potentially revise the URL with a different username and spoof the real username.  I was required to “blur” the parameters being passed so that someone looking for specific parameters would no be able to determine what was being passed.

I developed IFrame64 as a super-set of the DotNetNuke IFrame module that will allow users to easily blur the parameters being passed to other pages / documents / sites.  IFrame64 can create a URL like www.othersite.com?x=VXNlcm5hbWU9aG9zdA==.  Where the VXNlcm5hbWU9aG9zdA== is a Base64 encoded string containing username=myusername.

The module extends the existing IFrame with several new options:

The Display URL option allows the user to see the URL passed to the other page.  The option is helpful in testing and debugging.  This option is not recommended for production and should be disabled prior to moving to production.

The Must be Logged In option allows the user to define a message to be display when an anonymous user gains access to the page where this module located and the option is enabled.

Encoding of parameter is set to none by default, however this can be changed to Base64 encoding or to Encryption.  The Encryption is based on the site keys associated with each individual Dotnetnuke site. 

Create a Single Parameter when enabled will create a single parameter for all the key-values pairs defined.  All the key-value pairs will be combined into a single string and Base64 Encoded.

Note: The receiving page / site / document must be able to interrupt the encode/encrypted data.  You may need to revise the target page / site / document accordingly.
 

The following is an example of creating a single blurred parameter (name blurred - can be whatever user defines)

Highlighted in yellow is the URL passed to the frame.

Since IFrame64 is based on the DotNetNuke IFrame module, they share the IFrame_Parameters database table.  Therefore, the IFrame module MUST be installed prior to installing the IFrame64 module.

You can view download the module from Tressleworks from here 

Enjoy
Paul.