I am using the following code to embed one url. everything is working fine but there is security concern about user credentials. Is there any way to mask or hide user name and password from the code
</head>
<body >
<iframe src="<?php echo($url) ?> " width="100%" height="500px"></iframe>
</body>
</html>
<?php
}
else
{
header('Location: index.php');
}
}
else
{
header('Location: index.php');
}
?>
You indeed have a general security issue if you try to hand over user credentials as part of a request URL. That is considered bad style, for example it also means they appear in all server and proxy log files, a well known attack scenario...
Those credentials should not be visible at the client side at all, since that means they are out of your control. Instead you can try to proxy the potential iframes content via your server. So the iframe request goes to your server, without any credentials. On the server side you have all required information and it is still under your control, not accessible for the client side. You can use it to make a request to that final URL in background and relay the response to the requesting client which will visualize it inside the iframe. That also gets you around the cross origin issues you will run into otherwise.
The proxy setup depends on what you actually want to do: if that final target URL to be proxied is static, then you can setup a proxy directive using the features the http server itself offers. That is robust and efficient. If that final URL is dynamic, then you need to use a script based proxy approach, so typically another php script performing that part.