0

I have a web app (html5,javascript,css ..) with a connection page,

but in this page i only put the password in a JavaScript file to do the test, than i have figured out that any one who can open the google chrome console can see the password.

So i want to put the password in a distant secure file in my case webserver wamp how can i do it ?

I've read about cgi scripts but i don't know how to use it, please if you have any tutorials or an ideas like ssl or something else i'll be very thankful.

5
  • You can't. Anything that you send to the client [aka javascript, ajax requests] can no longer be considered 'secure'.
    – Sammitch
    Sep 13, 2013 at 20:26
  • possible duplicate of Easy way to password-protect php page
    – cmorrissey
    Sep 13, 2013 at 20:26
  • @Sammitch so you have another idea to make it secure ? because it's only a code that the user must type and that's it
    – imaneustre
    Sep 13, 2013 at 20:31
  • Are those php & cgi just random tags there, then?
    – maraspin
    Sep 13, 2013 at 20:35
  • no, i'm thinking that i can store the password in a php file in webserver , NOT in javascript file with ordinary test of verification
    – imaneustre
    Sep 13, 2013 at 20:37

1 Answer 1

0

If you match a password with anything on the client side, then your application is NEVER going to be secure. You want the provided password to be matched against something which the user does not see.

Start from here to better understand differences. And then take a look here for an implementation. It uses a database backend. But you could easily replace that with file content matching. After that, most likely you'll need to work with a session to ensure authentication is enforced.

Although I do not recommend it, if you're in a hurry and don't need too much security, you can also take alook here.

3
  • thank you for the links , But i only have one code , i don't want to create a database with one table and on column + i already have a database with 45 tables and i don't want to add something on it . because that code is only a secure thing to ensure that user know th code to go further in my app
    – imaneustre
    Sep 13, 2013 at 20:56
  • okey, i'm gonna my question more clear . actually this is a hybrid android app (built with html5 and javscript,css ...), so that password is saved in javascript localy in the android. Is it save or not ?
    – imaneustre
    Sep 13, 2013 at 21:16
  • No. Nothing you do in javascript is safe, since it's client side code. It then depend on the context. If each user has its own password, and it's not highly confidential stuff, you could decide to put in there. I wouldn't do it, but again, context matters. Also, I suggest that you read that link to get an idea. Get what you need and skip the rest. Don't need a new table, don't create it. Use the one you already have. My 2cc
    – maraspin
    Sep 18, 2013 at 0:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.