I want to display an external site (over which I have no control) in an iframe. Someone using my site can have or not have an account on that other site. That site requires membership (which is free) to see any content. In either case, I want to display that other site as a dummy user I made on that site. How do I do this?

I tried using the iframe module and have the iframe point to https://othersite.com/content?email=myemail&password=mypassword, but that seemingly did not do anything. When logged in with my regular user on that other site, the iframe was displayed for my regular user, when not logged in I got a page with a login button.

Can I trigger the pressing of the login button and then fill in the login form, or is it possible that that is not possible?

Edit: Using curl, I can first log in and then using the same session get the page I want. However, how do I put that out into an iframe? I've now got a variable containing the html of the page I want to show in an iframe between fields belonging to a content type.

  • Are you using Drupal 7 or 8? – Wim Mostrey Jan 22 '17 at 13:41
  • I'm using Drupal 7 – Ernst Jan 23 '17 at 17:32
  • Just a thought - you may want to make sure you're not violating the terms of use of that other site. – marcvangend Jan 28 '17 at 14:13
  • @marcvangend: The terms seem not to be too friendly towards this indeed. I need to check with the owners before delivering this to end users. Neograph734's answer led me to check them. I still want to know how to do this technically though. – Ernst Jan 29 '17 at 4:47

The thing to keep in mind here is that an iframe runs on the client side. It is basically a browser within a browser. This also means that it will use an existing session if the client is logged in on the site (you already discovered this):

When logged in with my regular user on that other site, the iframe was displayed for my regular user.

The problem is that Drupal runs server side. Theoretically you should be able to use drupal_http_request() to send the login data to the other site, catch the session cookie and initiate a session. But that would initiate a session on the server, not on the client. The same with cURL, it would log the server in, not the client. So the iframe for the client would still show the login button.

In order to do something client side, your only option is probably to use javascript and perform an POST the login data to the other site. This unfortunately means that the data to login (username and password) also will be sent to the client. A little tech savvy user will be able to compromise your account on the 3rd party site. (If he changes your password, it would break your own site)

Can I trigger the pressing of the login button and then fill in the login form, or is it possible that that is not possible?

Unfortunately also no, browsers implement safety measures to prevent one site form interacting with another. You cannot use javascript (or CSS or anything else) to modify the site within the iframe.

For a second I thought you can try to start the session on the server and then send the session variables to the javascript to process client side. This will not expose your credentials but will still allow someone to take over your session.

So I will conclude with no. There is unfortunately no sensible way of doing this.

Finally there are 2 more things to keep into account;

  • Do the terms of use of the other site allow you to share an account with multiple users (you could get into a lot of trouble)

  • What if the client happens to already have an account on the site? You would override his session and he would be you. I would personally hate your site if it forced me to logout and in again on another website.


You will need a single sign-on (SSO) set-up for this. My advice would be to install the CAS module and follow these detailed instructions. Once you have this configured, any user that is logged in on your site is also logged in on the other site, be it in an iframe or not.

  • That looks interesting, and if the other site is implementing that protocol it might work. However, I don't know whether it is, I assume it isn't, since it is not mentioned and it's a commercial site. I'm going to try and see. Any tips for checking that would be greatly appreciated. Another thing, can I then have anonymous users automatically log in to my dummy user without having to give any credentials? Neither to me, nor to the other site. – Ernst Jan 23 '17 at 7:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.