How to securely authenticate content embeded in another site?

Question

I need to embed password protected content to a second domain with an iframe. The content itself is a view which will be displayed on a third party site via an iframe and the content is prepared with a custom page and template handing the display. The use case is to present the view on the other site without the users needing to login. From my research, Oauth or Services seem like good candidates, but I don't have much experience with both and using a service to show a single view seems like it might be an over complication. Anyway, I haven't found much in the way of good documentation on the subject so I'm hoping for a good introductory overview of how to implement this. So, what is the best way to securely authenticate the drupal content on another site. I don't want to expose user credentials in the src=url in the frame for security purposes, so I know I need to use another authorisation mechanism. I've looked at the Entity Iframe module, which seems to have some of these features but the module mainly works drupal-to-drupal, and I haven't been able to tangle apart how the module handles the consumer/provider communication.

So, from researching this, I believe that I have to configure oauth and pass the token to the URL in the iframe. What I am unclear about is how to configure oauth access to the page and how to generate the token to be supplied to the iframe.

Answer 1

1- build the content structure well in your first site and create a view from admin/structure/views/add that return the data needed to the second site which acts like a client consuming your first site content.

2- Download and enable Services module and enable the submodule Rest Server and submodule OAuth Authentication now you can create secured resources to be consumed by any other sites.

4- create an end point from admin/structure/services/add and choose authentication type as your case "OAuth Authentication" will fit as you need to authenticate the client "the second site consumes your data".

3- Download and enable Services views module that will help you expose any view as a resource to be consumed and managed via services and

4- From the view you have created before click the button Add and choose services, now the view will appear as a regular resource in your site under admin/structure/services/list click edit resources to see it named with your view name enable it and choose the required authentication and authorization.

Now any authenticated client client site or App can consume that resource from http://YOUR_SITE_DOMAIN/END_POINT/VIEWS_SERVICES_URL.

The last and the most important part in your requirements is to configure the authentication method and test it will I recommend below helpful tools and articles.

Chrome rest client extension to test the webservice.

Very helpful article about services module

Another helpful article

Answer 2

I think you should create a service on your first site to export the view's data as JSON via REST, grab it on your second site, and display it. That is a more secure way.

In your REST service you can use OAUTH and request tokens, or a username and password.

Blog/Using REST Export With Views In Drupal 8 could help you.