473,782 Members | 2,458 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

JavaScript in Password Protected Folder?

Hi All,
I am trying to hide my JavaScript source. The method I chose was to
keep all the important source in a password protected folder, and then
use a SRC="folder/script.js" to include it in my code. This way, the
script will run, but the user will be unable to view the included
code. Or so I think :).

I have tried this method, and it seems to work. However, I would like
to know if you can see any problems with this. For instance, can you
think of a way to bypass this and get at script.js? Can you foresee
any problems that would arise as a result of keeping scripts behind
password protected folders? Any other security concerns?
Thanks in advance.
Jul 20 '05 #1
22 2244
<xm****@yahoo.c om> wrote in message
news:4a******** *************** ***@posting.goo gle.com...
I am trying to hide my JavaScript source.
Why?
The method I chose was to keep all the important source in
a password protected folder, and then use a SRC="folder/script.js"
to include it in my code. This way, the script will run, but
the user will be unable to view the included code.
Or so I think :).
You are wrong.
I have tried this method, and it seems to work.
Anyone who knows enough about javascript to be able to do anything
useful with the source will probably know several ways of viewing the
source once they have access to the page that imports it.
However, I would like to know if you can see any problems
with this. For instance, can you think of a way to bypass
this and get at script.js? Can you foresee any problems
that would arise as a result of keeping scripts behind
password protected folders? Any other security concerns?


It isn't going to work. You can restrict access to the page but once
someone has access they can read the source code, because you will be
sending them the source code.

Richard.
Jul 20 '05 #2
xm****@yahoo.co m wrote:

I am trying to hide my JavaScript source. The method I chose was to
keep all the important source in a password protected folder, and then
use a SRC="folder/script.js" to include it in my code. This way, the
script will run, but the user will be unable to view the included
code. Or so I think :).

It would surprise me if a client's browser can load the script without
having to log in, if so that's a security bug in your webserver. Also
this will *never* hide your scripts, as soon as the browser loads them
they're available either in the cache (read: on disk somewhere) or just
by viewing them in your browser. It's not possible to hide JavaScript
source code.

Cheers,

Guido

Jul 20 '05 #3
xm****@yahoo.co m wrote:
Hi All,
I am trying to hide my JavaScript source. The method I chose was to
keep all the important source in a password protected folder, and then
use a SRC="folder/script.js" to include it in my code. This way, the
script will run, but the user will be unable to view the included
code. Or so I think :).

I have tried this method, and it seems to work. However, I would like
to know if you can see any problems with this. For instance, can you
think of a way to bypass this and get at script.js? Can you foresee
any problems that would arise as a result of keeping scripts behind
password protected folders? Any other security concerns?


Open your page in IE.
File>Save As and save it.
Theres the .js file, in a folder all of its own.
--
Randy
Chance Favors The Prepared Mind
comp.lang.javas cript FAQ - http://jibbering.com/faq/

Jul 20 '05 #4

JavaScript is a client side script, by definition, it's processed by th
client's browser. If the browser can access it, then the user can als
see it.

If you put it in password protected folder and a client does not hav
access to that folder, then his browser will not be able to get th
script.

Basically, I don't think there is a way to hide javascript.

Just like you can't hide

.css style file.

xm****@yahoo.co m wrote:
*Hi All,
I am trying to hide my JavaScript source. The method I chose was to
keep all the important source in a password protected folder, an
then
use a SRC="folder/script.js" to include it in my code. This way
the
script will run, but the user will be unable to view the included
code. Or so I think :).

I have tried this method, and it seems to work. However, I woul
like
to know if you can see any problems with this. For instance, ca
you
think of a way to bypass this and get at script.js? Can you foresee
any problems that would arise as a result of keeping scripts behind
password protected folders? Any other security concerns?
Thanks in advance.

Jul 20 '05 #5
[top posting fixed]
xm****@yahoo.c om wrote: <snip>
I am trying to hide my JavaScript source. ...

<snip>
"StanD" <St**********@m ail.forum4desig ners.com> wrote in message
news:St******** **@mail.forum4d esigners.com...
JavaScript is a client side script, ...

<snip>

Pleas do not top-post to comp.lang.javas cript. The group FAQ outlines
acceptable posting style in section 2.3 paragraph 5 and references the
applicable standard.

Your posting software appears to exhibiting faulty behaviour in its
handling of the "References " header in your postings. It has sent (split
across lines at the location of spaces to avoid uncontrolled wrapping):-

References: <4a************ **************@ posting.google. com>
<c0************ *******@news.de mon.co.uk>
<40************ *********@news. xs4all.nl>
<Ao************ ********@comcas t.com>

But:-

| RFC 1036 Standard for USENET Messages December 1987
|
|
| 2.2.5. References
|
| This field lists the Message-ID's of any messages prompting the
| submission of this message. It is required for all follow-up
| messages, and forbidden when a new subject is raised.
| Implementations should provide a follow-up command, which allows a
| user to post a follow-up message. This command should generate a
| "Subject" line which is the same as the original message, except
| that if the original subject does not begin with "Re:" or "re:", the
| four characters "Re:" are inserted before the subject. If there is
| no "References " line on the original header, the "References " line
| should contain the Message-ID of the original message (including the
| angle brackets). If the original message does have a "References "
| line, the follow-up message should have a "References " line
| containing the text of the original "References " line, a blank, and
| the Message-ID of the original message.
|
| The purpose of the "References " header is to allow messages to be
| grouped into conversations by the user interface program. This
| allows conversations within a newsgroup to be kept together, and
| potentially users might shut off entire conversations without
| unsubscribing to a newsgroup. User interfaces need not make use of
| this header, but all automatically generated follow-ups should
| generate the "References " line for the benefit of systems that do
| use it, and manually generated follow-ups (e.g., typed in well after
| the original message has been printed by the machine) should be
| encouraged to include them as well.
|
| It is permissible to not include the entire previous "References "
| line if it is too long. An attempt should be made to include a
| reasonable number of backwards references.

- would require that the References header of a message that appears,
from the quoted material and its attribution, to be intended as a
response to the OP should carry the header:-

References: <4a************ **************@ posting.google. com>

And if intended to be a response to any of the other contributors to
date would be only the References header from that "original message"
(singular) followed with a space and the message ID of that message.

While the header that you sent contains the message IDs of all of the
contributions to the thread to date and will probably give most
newsreader software the impression that it is Randy that you are
responding to (or just confuse it). It is important for newsreader
software to be able to accurately represent which messages are replying
to which other messages and they need meaningful References headers in
order to be able to do that. Hence the clearly specified format and
contents of that header and the fact that it is required in messages
that represent responses.

If you are going to post to Usenet, in addition to making yourself
familiar with the conventions of the groups that you are posting to, it
would be a very good idea to be using software that does not violate
such an important aspect of the applicable standard.

Richard.
Jul 20 '05 #6
StanD wrote:
JavaScript is a client side script


But that is not all its limited to. Before one posts as horribly as you
did, you should read the FAQ, about 8 times or so, and then read it 88
more times.
--
Randy
Chance Favors The Prepared Mind
comp.lang.javas cript FAQ - http://jibbering.com/faq/

Jul 20 '05 #7
Richard Cornford wrote:
While the header that you sent contains the message IDs of all of the
contributions to the thread to date and will probably give most
newsreader software the impression that it is Randy that you are
responding to (or just confuse it).


It confused mine. My reply to Stan is showing as a reply to you, when it
was actually a reply to Stan (I read/replied to his before I read yours).

--
Randy
Chance Favors The Prepared Mind
comp.lang.javas cript FAQ - http://jibbering.com/faq/

Jul 20 '05 #8
"Randy Webb" <hi************ @aol.com> wrote in message
news:Zp******** ************@co mcast.com...
<snip>
While the header that you sent contains the message IDs of all
of the contributions to the thread to date and will probably
give most newsreader software the impression that it is Randy
that you are responding to (or just confuse it).


It confused mine. My reply to Stan is showing as a reply to you,
when it was actually a reply to Stan (I read/replied to his before
I read yours).


I can't tell how the threading is going to come out on my newsreader yet
as I can see both of your replies (as responses to stanD) but my post
hasn't shown up yet. It appears to have made it across the Atlantic but
hasn't yet managed to propagate across the room at my ISP from the
receiving box to the reporting box (or could they be on different
continents?).

On the plus side both of our newsreaders have followed RFC 1036 to the
letter. (I assume you noticed the organisation originating this latest
nonsense; another great contribution to the Usenet community.)

Richard.
Jul 20 '05 #9
"Richard Cornford" <Ri*****@litote s.demon.co.uk> wrote in message news:<c0******* ************@ne ws.demon.co.uk> ...
<xm****@yahoo.c om> wrote in message
news:4a******** *************** ***@posting.goo gle.com...
I am trying to hide my JavaScript source.


Why?


Because the organization wishes to protect its source code, since it
is proprietary and may reveal internal details that we prefer to keep
secret.

Thanks.
Jul 20 '05 #10

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

3
1605
by: netsurfer | last post by:
hi..I'm working on a project that requires files to be password protected on a UNIX based site. The people that own the web site want to be able to change the password every so often. Unfortunately, I have restricted access only to FTP so I really can't log in to any kind of Administrative Console or Admin Panel and see if there are folders that can be password protected and then have passwords changed on them. The people I'm contracted...
3
1754
by: Ronan Dodworth | last post by:
Hi there I'm having a little bit of a problem with my customvalidator control. The problem is the javascript runs fine on my local webserver IIS but not when I post it to the web hosting server. As it is client side scripting I'm suprised that this is the case as I'm using the same browser IE6 and the same machine to access both. I've included the code below. Can anyone help . I've tried lowering all the security settings for intranet...
2
1813
by: DanB | last post by:
I am using VB DotNet Std Edition and am writing a web application that needs to read and write to an password protected database. The mdb files reside in a folder (fpdb) under the localhost (c:\inetpub\wwroot) Within the IDE I can view the data using the server explorer and I use that same oledb connection for the web form. I have tried accessing a non-password protected db in the same folder using
4
7570
by: kthiagar | last post by:
Hi I am trying to connect to a password protected access file from VB.NET. I have no problem in connecting to Access, if I remove the password. This is what I am doing: In the server explorer, I choose "Add a connection" Choose "Microsoft Jet 4.0 OLEDB Provider" in the provider tab Selected the access file in the next tab Left Username as Admin and typed the password. Now when I try to test connection, I am getting this error message:
1
1633
by: Tull Clancey | last post by:
Hi all. I have an app that needs to create a folder off the installation folder, this is not a problem. But, I need to password protect this folder so only the application can get access to the data stored there. Of course a user can add a password to a foler, but how can I do this from within my code, then how would I open a file within this password protected folder?
0
1365
by: sonicpulse | last post by:
Hello, I made a program that iterates through all the pdf's in a folder and opens them and prints them. However, all of these pdf's are password protected, so I have to manually type in the password many times. Is there any way to open a password-protected PDF with the password entered through python? Thanks
0
1097
by: vien | last post by:
hi there i'm vien i'm looking for a vb code that can make folders in windows explorer to be password protected sothat if some one want to open the folder, delete the folder,or move the folder; the folder should ask for a password. The folder should be accessed only for those who have that password. is any body has any idea? thanks for help
3
2487
by: Charlotte | last post by:
Hello, info: I'me a rookie with IIS I have on a WinXP Pro the IIS installed, so I can test some pages before uploading to the hostserver online on the hostserver is a possibility (with the program PLESK) to make a directory secure (to access a page in that directory, you have to give a username and a
3
9215
by: fndofu | last post by:
I recently protected(made protected and invisible) a folder with "FILE and FOLDER protector" software....But unfortunately i forgot the password that i used........... Cud u please tell me how to access the files in the folder... The name of the folder is "new" and it was in "D:\" drive..Now i need to access the hidden folder(Show hidden folder's option didn't work)...I h'v heard that using some simple commands v can easily unprotect...
0
9641
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main usage, and What is the difference between ONU and Router. Let’s take a closer look ! Part I. Meaning of...
0
10313
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. Here is my compilation command: g++-12 -std=c++20 -Wnarrowing bit_field.cpp Here is the code in...
0
10146
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth. The Art of Business Website Design Your website is...
0
9944
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
0
6735
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...
0
5378
by: TSSRALBI | last post by:
Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...
0
5511
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
1
4044
by: 6302768590 | last post by:
Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system
2
3643
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.