Electronic libraries at work and at home

Inspired by the article about science under lock and key . Although my article is not about this, but also about access to electronic libraries, although of a different nature.

I work in the West ... not, nevertheless, a northern university, and I have to read quite a few articles from my field of study. Fortunately, here the university library is subscribed to many electronic libraries (I wonder how much this pleasure costs ... not, not so - how many bourgeois are cashing in on our articles?). In my subject matter, there are three such libraries - ACM, IEEE and Springer. And in them - the lion's share of what I need. And everything would be great, but there is one BUT.

Electronic libraries (DL) identify users, apparently, by IP. Maybe I'm wrong, but access to them is open only if the computer is physically (through a twisted pair) connected to the University network. At least, on the villages of DL it is listed under whose subscription I can download articles. All you have to do is to connect to the University’s network wirelessly, as soon as the EB begins to ask for money for the article. It is clear that outside the university I see only the tariffs for reading the work of colleagues and of my own.

And what if I decided to work at home (well, I’m kidding: who can do this in the presence of three scamps ...) well, or on a business trip I needed to check something, refine, or just read, in the end-ends (very real case) ? At some point, I decided that it was necessary to somehow solve this matter. The local admin rejoiced me only because I was not the first to ask him to come up with a solution on how to access the DL remotely. Without promises to do anything. Later I learned from a colleague that there is some solution on a national resource, but it works somehow unstable - despite the fact that a colleague showed how she connects to the DL through this resource, for some reason, the same actions did not lead to the desired result. .
')
That's when the decision appeared to do everything myself, because there are some small PHP and JS programming skills. As well as the fact that there are user folders on the local network (from which the subscription to the DL is valid), and PHP scripts can be placed in them. The idea looked like this:

• place the proxy in your folder on the local University server,
• write an extension under google chrome to
• All links leading on the DL pages “not there” (not on PDF articles) would change on the fly, i.e. everything would look as if there is no proxy and articles open up as if you are working from the internal network of the University.

After searching for PHP, the proxy was taken by a simple script (thanks to Eric-Sebastien Lachance) that sent all HTTP headers (that is, including the user's cookie). True, it had to be greatly expanded to 1) limit the number of domains to which a user can access, and 2) only students and employees of the University can use it (you know why it cannot be made available to anyone ...), and This check whether the user is logged on to the local network (Intranet, you can log in remotely; by the way, this step can be omitted if you use only yourself). To do this, every request, except for the actual URL to the PDF of the article, must contain the ID of its session on the Intranet. The proxy makes a request for the Intranet page, setting the desired cookie (JSESSIONID in my case) to the transmitted value, and if a positive response comes from the Intranet, it performs a request to the EB.

The Google Chrome extension works on the user’s side (it consists of two parts — the code embedded in the page and the code with access to tabs and cookies running in the background), and if the URL is in one of the three libraries, the page is scanned for certain elements that should be on every page where there is a link to PDF articles (for each DL, of course, these are different elements). If such elements are found, then a proxy request is inserted there with a well-formed link to the PDF article. (The search for how and from which of the data on the page to correctly form a link took quite some time).

When clicking on this link, the value of the cookie that contains the session ID on the University Intranet is added to the request.

True, in order to open articles on IEEE had to tinker a lot. It turns out that for IEEE you need to open any page on its DL website through a proxy (in Chrome, an additional tab opens, which closes immediately after the content is loaded) in order to receive a cookie from it with user identifiers with a subscription. Plus I had to conjure with the replacement of the domain and path values ​​in the received cookies (the latter was optional) in PHP, so that they could be automatically transmitted along with the request for PDF to the proxy: they came (after this additional request to get identifiers) as domain = ieeexplore.ieee .org, and the link to the PDF already pointed out not to .ieeexplore.ieee.org / query, but to university.org/~user/proxy?url= ieeexplore.ieee.org% 5Fquery, so you had to edit them to domain =. university.org, path = / ~ user / proxy.

The last thing I want to point out is that these are the weak points of this implementation:

• If something changes in the layout of the DL pages, this solution will stop working. But while it works it is very convenient: logged in on the Intranet, and work
• There are some security issues: the session ID is passed over HTTP, and potentially it can be intercepted. While I alone use this solution, the risk seems to me to be zero - how does the attacker know what kind of numbers I transfer to the proxy? However, if he examines the extension, accessing someone else's account on the University Intranet will be a matter of technology. And HTTPS doesn’t extend to the user directories on our server ... It may be necessary to use session identifier encryption in the extension ( CryptoJS ) and server-side decryption ( OpenSSL ), as I ’m still planning to send the extension to my colleagues

And here is the full source code .

PS If someone knows the best and the same convenient solution, please share. You can take code, use, edit, share, etc. In general, there is an idea to fill it with github, and if there are wishes in the comments, then I will.
PPS For the code, do not scold too much - it took more time to figure out which send requests were needed (especially for EB on IEEE) than on the code itself. It may also be incomplete - it is not always to substitute the correct link.