?

Log in

No account? Create an account
Suddenly I realized something was wrong... - LiveJournal Client Discussions [entries|archive|friends|userinfo]
LiveJournal Client Discussions

[ userinfo | livejournal userinfo ]
[ archive | journal archive ]

Suddenly I realized something was wrong... [Jul. 26th, 2004|04:58 pm]
LiveJournal Client Discussions

lj_clients

[fbartho]
[mood |stumped...]

I am stuck... Am working slowly but surely on my plan to interface livejournal with my website via php, and I suddenly realized that the xmlrpc method needs to be told who the viewer is... as of now, it only posts the most recent journal entry on my site: http://digitalsneeze.com/forums/ffb_ljsetup.php?uid=2 and it completely does not check if the reader is authorized to do so... that means if my last post is private, anyone can see it, but what i realize the only method around this is that when a user logs in to my site, it also logs in to livejournal, meaning it needs access to existing livejournal cookies and the ability to make new ones if i need to... Am I mistaken here? and if not, what do i do? Let me know what you guys think...

Thanks,
>>Frederic
linkReply

Comments:
From: snej
2004-07-27 07:24 am (UTC)
Wouldn't it be so much easier to simply grab your journal's RSS or Atom feed, parse out the first entry, and display that? Then you don't have to worry about logins or cookies or XML-RPC or privacy issues.

But if you want to continue with the way you're doing it...

When you grab the post, you have to check its security level. If it isn't public, then skip to the next one.

The cookies your PHP code uses to talk to LJ are completely unrelated to the user's cookies they use to access your site. PHP is sending its own HTTP queries from your server. If you want to send cookies, you'll have to add them explicitly. Your server in fact has absolutely no way to access the LiveJournal cookies of the viewer — that would be a huge security violation.

If you really want people visiting your site to see non-public LJ posts of yours, you will have to manage logins on your site. You'll have to make users log into your site and enter their LJ usernames and passwords so you can pass them on to the LJ protocol. This seems like a really, really bad idea to me. There is no way I am going to entrust my LJ password to anyone (except maybe my wife).
(Reply) (Thread)
[User Picture]From: fbartho
2004-07-27 08:29 am (UTC)
Well, first off, I intend to make this a nearly fully featured web-based client to livejournal... thus I can't have the feeds, because that would not give me the amount of history I would want [all]... I'm not trying to get only the last post, that was just the stock configuration of the php code I found... I first worked on interfacing that with my site, which has succeeded, now I have a few more details on that side after which I will be modifing the fetch code... what I was hoping was to be able to either query the cookie from www.livejournal.com or livejournal.com for who the user from this computer is... I know that I will have to manage logins on the site, and I intend to encrypt passwords and store them in my database... now I know few security concious people would like my holding on to an extra password of theirs, but its an optional service... along with this, people who are security concious wouldn't use a secure password of theirs to login to a non-essential website such as live journal...

The idea of the reading of the livejournal cookie was just to get a valid username that they had registered under, but i can just as well process that with my own cookies, have it query livejournal based on the livejournal username and password stored on my site.

I am going to need to look up the specs on how they give security levels, because i may have to fetch user groups to find out if a user has access

[I am an optimist, always have been, but realistically:] I am very skeptical about the number of people who will ever actually use my site... The people who will hear about it will be my friends...

[some more thoughts/features] The people who will use it will be a subset of those... The fun thing is that my site will allow me to make an extension of the permissions so that people without livejournal accounts will still be able to make comments and to read my private entries, because I will allow people to add non-livejournal usernames...
I also intend to implement a probably poorly documented, but immensley flexible completely free style system, (unless I see serious money in having people pay to use it) whereby, people will be able to specify an entire html page... (I am assuming that that is what making your own S2 layout amounts to, haven't tried it) What will be fun in all this is the fact that I enjoy coding, and so making my site work will be an interesting challenge, I will have to find a way of validating the javascript code in scripts that I intend to let people use... I think I'll have to draw the line at the eval statement though, as well as external sources for javascripts... no java tags, (should I allow iframe? probably not) ...

damn very spastic entry, my apologies...
(Reply) (Parent) (Thread)
From: snej
2004-07-27 09:17 am (UTC)
"Well, first off, I intend to make this a nearly fully featured web-based client to livejournal"

I don't get it. There already is a fully featured web-based client to LiveJournal.

"what I was hoping was to be able to either query the cookie from www.livejournal.com or livejournal.com for who the user from this computer is"

You absolutely cannot do that. The client's browser will not send your server cookies for any site other than your own. That's the basic security requirement of cookies. You might want to get a book on HTTP, or google for the design specs for cookies.

As for keeping the passwords yourself, let me say again that cross-site password storage is a terrible idea. All it takes is one vulnerability on your site, and crackers can get people's LiveJournal passwords and wreak havoc with them on livejournal.com. Internet security is a very serious and difficult undertaking, and it's IMHO irresponsible to make a web app that risks another site's security.

"I am very skeptical about the number of people who will ever actually use my site... The people who will hear about it will be my friends... "

That's pretty much exactly what bradfitz thought in 1999 =)
(Reply) (Parent) (Thread)
[User Picture]From: fbartho
2004-07-27 09:54 am (UTC)

hmmmm...

As to your first question, you are very right, I just want to add some functionality to my site that would let my users group together their blogs if they want on a page on my site... They can choose to post to my forums, or to their blog after a single choice of a link, and the site will also have an alternate to having a livejournal account, if they don't have one, they can still post, it will just be stored on my site rather than on livejournal...
Now, with respect to the cookies issue, the fact of the matter is that I knew/know most of the issues, problems, and security concerns with cookies specifically, but what I was hoping was that there was some way to somehow query livejournal as to this computer's users lj name... thereby bypassing the need for a login to the site to determine the user's premissions... My main issues are not too much with cookies... they are more with my inexperience with livejournal and its possible access methods...

I have alot of random ideas sometimes about things i could have done were i to make such and such site, and even though I intellectually know that alot of them would just simply never fly due to them being unreasonable for large scale systems... in this case my hope was for a way to "proxy" the livejournal through to the user's computer, and if they were logged in, read the username from that "proxy" and if they were not logged in, cause a cookie to be formed somehow, ie prompt livejournal to set a cookie on their computer...(of course proxy isn't quite the right term to describe what i was hoping for, but it is some approximation)
Now about that cross-site scripting... I do hope that the only thing that happen is for a user's account to be hijacked and then destroyed, plus spamming from the hijacked accounts...

if there is more I should fear, please let me know, I wouldn't actually want to risk the integrity of livejournal
[Error: Irreparable invalid markup ('<br [...] code,>') in entry. Owner must fix manually. Raw contents below.]

As to your first question, you are very right, I just want to add some functionality to my site that would let my users group together their blogs if they want on a page on my site... They can choose to post to my forums, or to their blog after a single choice of a link, and the site will also have an alternate to having a livejournal account, if they don't have one, they can still post, it will just be stored on my site rather than on livejournal...<hr>Now, with respect to the cookies issue, the fact of the matter is that I knew/know most of the issues, problems, and security concerns with cookies specifically, but what I was hoping was that there was some way to somehow query livejournal as to this computer's users lj name... thereby bypassing the need for a login to the site to determine the user's premissions... My main issues are not too much with cookies... they are more with my inexperience with livejournal and its possible access methods...<br><br>I have alot of random ideas sometimes about things i could have done were i to make such and such site, and even though I intellectually know that alot of them would just simply never fly due to them being unreasonable for large scale systems... in this case my hope was for a way to &quot;proxy&quot; the livejournal through to the user's computer, and if they were logged in, read the username from that &quot;proxy&quot; and if they were not logged in, cause a cookie to be formed somehow, ie prompt livejournal to set a cookie on their computer...(of course proxy isn't quite the right term to describe what i was hoping for, but it is some approximation)<hr>Now about that cross-site scripting... I do hope that the only thing that happen is for a user's account to be hijacked and then destroyed, plus spamming from the hijacked accounts... <br><br>if there is more I should fear, please let me know, I wouldn't actually want to risk the integrity of livejournal<br><br now for the rest, I will of course explain the risks to my users... and they will have to sign off about it... for stuff that accesses my database that will have lj data, I am using phpbb who as a large coding group with an established history of working to prevent vulnerabilities, I generally trust a bit more to test their code, and I am pretty meticulous in the code I add to modify it, so that i don't provide my own vulnerabilities...<hr>This whole project, my whole website in fact is something I enjoy doing... It is not that I see a <i>need</i> for something perse, but rather that I see the possibility for something I, and possibly others could enjoy... and assuming that I don't create horrible hazards to other peoples enjoyment of the internet then it amuses me to slam my head into a brick wall until i get the code up and running... and lol I definitely don't attempt to compare myself to <lj user="bradfitz"> though I wouldn't mind a similar outcome... :D
(Reply) (Parent) (Thread)
From: snej
2004-07-27 10:38 am (UTC)

Re: hmmmm...

"what I was hoping was that there was some way to somehow query livejournal as to this computer's users lj name"

What's "this computer"? All you know about the machine the browser is running on is its IP address (which is not accurate if it's behind a NAT or proxy) and any cookies it's storing for your website. There's no way LJ could make anything meaningful out of that

"cause a cookie to be formed somehow, ie prompt livejournal to set a cookie on their computer"

But the only way that could happen is if their browser contacted LiveJournal directly. You don't seem to understand that your server being in the middle makes it a fundamentally different situation than the user's browser talking to LJ.

Cross-site authentication like what you're trying to do is, at this point in time, still in the domain of rocket science. Microsoft's Passport tried to do it. The Liberty Alliance has been working for years on a secure way to do it. It's not going to be a simple matter of using some cookies, unfortunately.
(Reply) (Parent) (Thread)
[User Picture]From: fbartho
2004-07-27 12:21 pm (UTC)

heh.

well see what you think i am describing clearly is in the realm of fiction at the moment and your point about the ip, is the reason why I put proxy in quotes, I guess the clearest version of what that whole cookies scenario was trying to accomplish was to somehow route the user to livejournal, have the cookie be set and retrieved by livejournal essentially transparently but my site would get the username data from that exchange and the transparent page would then redirect back to my site... hehehe... hmmmm... like I said its one of those things that i bet could be implemented relatively easily, but there would be little point for livejournal to do so, and it would probably not scale well taking up alot of time/computations for livejournal... So basically I follow exactly what you are saying, that you showed me in probably your first comment that my wishful thinking needed to be brought down to earth, and the rest of this is just me alternately whining/trying to explain what my wishful thinking would have liked... and since I'm wishing, I might as well ask for the cross-site logins to be implemented... :D

Thanks for the answers...
>>Frederic
(Reply) (Parent) (Thread)