How to hide Password Protected pages from General Search Results

[mjg234]

I read the FAQ "How do I index protected parts of my website requiring user authentication?" (http://www.wrensoft.com/zoom/support/auth.html) and understand how to index Password Protected content. How is this content then restricted when it comes to returning Search Results?

In other words, if the website visitor has not logged in yet and does a search, we would want to return X pages (all pages that are visible to anyone) in the Search Results; however, if they are logged in and do a Search, we would want to return those X pages PLUS the Y pages (those which require User Authentication to access) in the Search Results.

Thank you.

[David]

There are several solutions.
The easiest one is to have 2 sets of index files. one private set and one public set.

[mjg234]

Thank you for the reply. I wondered about having two sets.

If I take this approach:

1. Do I need to create two Search Pages (one using the public set, and the other for the private set)?

2. To get the two sets of index files, I would need to run the Index process twice: once for public, and the other as an authenticated user. Correct?

Thank you.

[Ray]

Yes to both questions.

The benefit to this method is that it's relatively easy to set up, and that you can have proper security -- in that, a non-authenticated user can be prohibited from accessing the search page for the authenticated content, and they will never see the search results from the authenticated area.

The other methods may involve indexing all content (non-authenticated and authenticated) together and using categories to group them. For example, an authentication required page could have a meta tag like this:
<meta name="ZOOMCATEGORY" content="AUTHREQUIRED">

And you setup a category in Zoom Indexer matching this name "AUTHREQUIRED". Then you allow a user to search in either/both categories. The downside to this is that a user could potentially manipulate the HTTP GET parameters (the ones in the URL) to search in the other category. They will only see the results (and descriptions) however, they will still be prohibited when they access the actual URL with your existing authentications in place.

[ProtBron]

Thank you, Ray. Could you give a link or little detailed explanation of 1st method?