How can I avoid an iframe to be called directly?

[odtufatih]

I have an iframe in the middle of my site, and I dont want in anyway someone to directly address that iframe..

How can this be possible??

An idea may be passing a control variable from the main page to the iframe but someone still can open the iframe with including that variable at the end of the url..

[mrruben5]

Use authentication with php or use .htacces for this.

Here's the php way.
Or another easy one with sessions.

[delinear]

You could try something like this at the top of your iframe file:

PHP Code:

$mydomain = 'yourdomain.com';
if(strpos($_SERVER['HTTP_HOST'], $mydomain) === FALSE) {
    header('Location: http://www.yourdomain.com');
} 


The only problem is, because it's an iframe I'm not sure if $_SERVER will be populated with your server data or the data of the server belonging to the person linking it but you can test that pretty simply.

If it does cause a problem you could probably solve it by using css overflow to create a virtual iframe and including the file instead (I'm pretty sure an included file gets the server data of the calling page, not it's own server data), but if it gets to that point you may as well look at authentication as an easier solution.

[odtufatih]

I think I will set up a session variable in the page calling the frame and then check that variable inside the frame..Seems an easy solution, thanks for your help

[Fou-Lu]

Sessions are always the best route when passing data from page to page in your site. That includes blocking out things that can only be included or added to your pages. Go with that route, watch your session settings though, and test it with your cookies off (use_trans_sid is off by default in php.ini, which auto-appends your links).