Home/ Questions/Q 6804325
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T19:27:07+00:00

I know this isn’t going to be secure. But, I’d like to at least

  • 0

I know this isn’t going to be secure. But, I’d like to at least make some sort of attempt at minimally doing what I need to do.

We have a custom client that is built using the IE browser control. I can’t change this and it’s not in the scope of this question to change it. The problem is, if a user performs an action in this application that pops open a window, it opens the window in IE, and not the client application.

We have some export to CSV and print functions that open a new window. The information that they are printing or exporting depends on access control. So, when the window pops open in IE, they aren’t logged into IE; so no access control. I need to be able to pass the session over to IE so the user is logged in and the appropriate information prints or exports to csv.

Don’t necessarily need Fort Knox security. It’s not for a public web site and not secure data. But, is there any way to accomplish this without completely ignoring all security?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Create a token and store it in your db with a relation to the current user before popping up the window. Give the token a 60sec expiration time (adjust as needed) and add it to the end of the popup window url. When that url is hit, read the token and its association to a user. From there, you should be able to access your ACL controls.

    You won’t be transferring the session but you’ll know which user is requesting the popup. Hope it helps…

    WARNING: This isn’t very secure as the token will be vulnerable to man in the middle attacks. Adding the expiration functionality is an attempt to limit that possibility. This method could be considered security by obscurity.

    • 0