Problem with web screenshots requiring authentication.

Question

I am making app that takes a screenshot of a URL requested by the user. I want to make it as transparent as possible when sites that require username and passwords are in question.

For instance, if user wants to screenshot its iGoogle page, he will send the server URL but, the screenshot will not be the same as what he sees on his screen.

Is there any way to do this ? I guess that in such cases I will have to actually request screenshot from the user. Perhaps user can even deliver me his cookie for that domain.

Any thoughts ?

Ty.

Answer 1

Yes, in most cases you'll need user's cookies.

If site uses regular cookies, you can create bookmarklet that reads document.cookie. This will not work with httpOnly cookies which are used increasingly often for sessions.

Some sites limit sessions to certain IP, and in that case you can't take screenshot without proxying request through user's computer.

If you can get user to use bookmarlet, an interesting trick would be to read and send DOM to your server:

image.src = 'http://example.com?source=' +
            escape(document.documentElement.innerHTML);

For HTTP authentication easiest solution would be to ask user for login/password.