CodeStore.net comments on "Tips Week 2.5 - Secure RSS Feeds With Domino"

Reply from Tanny O'Haley

Tanny O'Haley

Yes, you can buy a cert for *.mydomain.com.

Reply from Jake Howlett

Jake Howlett

Yes, Mark, as far as I know you need two SSL certs if you want to have this extra subdomain added. Or can you buy a cert for *.mydomain.com? I can't remember.

Jake

Reply from Mark

Mark

Sorry to revive this after so long but I missed it first time round. This looks a fairly painless way to avoid session authentication for a server or domain but if SSL is also used on the host databases does this mean you have to provide a separate SSL server certificate for the rss.extranet.company.com domain?

Reply from Ben

Ben — Fri, 17 Mar 2006 17:03:00 +0100

Old hat to the admins that read this? Well, I can't be a very good admin then as I've never come across this.

Interesting post, nice workaround.

Reply from Jennifer Armentrout

Jennifer Armentrout — Fri, 17 Mar 2006 13:07:00 +0100

Thanks, Jake! I'd planned on tackling this in the near future and once again you came in with some much-needed advice and guidance.

Reply from Joel M. Phelan

Joel M. Phelan — Fri, 17 Mar 2006 10:36:00 +0100

Is it just me, or did the font shrink a lot today? It appears to be smaller than in the past. As a fairly recent lasik patient, things like this freak me out and I find that I'm staring at the sign on my wall to make sure I can read it.

Reply from Jerry Carter

Jerry Carter — Fri, 17 Mar 2006 09:14:00 +0100

Thanks, Jake. I'm not hitting this yet, but I'm pushing a client to adopt more Domino, so having this little tidbit in the back of my mind could prove quite strategic. :-)

Reply from Jake

Jake — Fri, 17 Mar 2006 07:45:00 +0100

Bill + Jens. Thanks. Glad to know it helped. I now know it wasn't an hour wasted.

Reply from Jens Bruntt

Jens Bruntt — Fri, 17 Mar 2006 07:40:00 +0100

Great stuff!

I was pulling my hair out a couple of months ago and then gave up trying to do what you just described.

Thanks!

Reply from bill e

bill e — Fri, 17 Mar 2006 07:17:00 +0100

That might be old hat to the admins that read this, but as someone that will be running into this issue in ... a couple months, I'm impressed!

Thanks Jake!

Reply from Jake Howlett

Jake Howlett — Fri, 17 Mar 2006 07:05:00 +0100

You could do Jonathan, but that's not really something you can sell to a customer or expect them to ask their users to do is it?

As developers we all know the credentials are sent this way, but there's no need to alarm the user with this fact. Better to let them believe otherwise and remain oblivious.

How would you add the RSS feed icon to the site, with their password (from the NAB) included in it, so that they could right-click-copy the URL to their aggregatorr?

Reply from Jonathan Hart

Jonathan Hart — Fri, 17 Mar 2006 06:48:00 +0100

You can also do the following:

Point the feed reader at

h t t p (s)://yourwebaddress/names.nsf?login&Username=YOURUSERNAME
&Password=YOURPASSWORDHERE&RedirectTo=/subdir/Feeds.nsf/rss.xml?openpage&category=All

Since your credentials are sent clear text anyway ;o)