I have an administrative RSS feed generated by views in a feature that needs to generate a random/unique URL so that non-admins can't easily stumble upon it. I know that after installing the feature, the user can easily manually create the URL, but this will override the feature and put it in the DB, making updates troublesome. Thoughts?
2
-
What you're asking for only provides <a href="en.wikipedia.org/wiki/… through obscurity</a>. Ask yourself: if someone does find these pages, then what? And what are the repercussions of someone finding the RSS feed itself? Instead of worrying about how easy the links are to find, what I would do is make sure that the links you are providing are only accessible to users with the appropriate permissions. With a bit more information, I would be happy to clarify my answer.– David WatsonCommented Mar 15, 2012 at 17:05
-
It is not the end of the world if somebody stumbles upon them. I just want to take the extra step to obscure them. I cannot add any permissions to the feed itself as it needs to be able to be read anonymously by a rss reader. I don't think I too crazy to look at something like this, since Drupal core already does this by generating a unique URL to run cron from outside the site.– TookieCommented Mar 15, 2012 at 17:18
Add a comment
|
1 Answer
Just configure the menu path for the page/feed display of your view to include a "random" token. You can set them to be whatever you want.
Users will require the token to trigger the menu item and therefore view. You can rotate the token by simply updating the view (though it's a manual process).
If you need to automate rotating the token, you could build a module that hook_menu_alter's access callbacks (yourmodule_access) onto the desired paths that checks the token (variable_get) that a hook_cron periodically updates (variable_set) and mails out to appropriate admins (users with some role). This has added benefit that it's not limited to use with Views. Though that's a bit complex for providing obscurity.
Also, many RSS readers support HTTP basic auth (via adding username:password@hostname to the feed URL), so you could install a contrib module that adds support for logging in via HTTP Basic.
-
And drupal.org/project/tokenauth supports the rest, and has an alphanumeric token. But it is not intended to be used in the creation of obscure URLs, just minimally authenticated ones.– GraysideCommented Apr 15, 2012 at 4:53