CODEWITHSUNDEEP
htmlauthentication
Szuturon
Szuturon

Reputation: 971

Making a page accessible only by password

What is the simplest way to make a page accessible by username/password? In school I learned to do this on the server side using sql and java. I'm wondering is there a way to do this only on the client side?

EDIT: lol... based on the responses, I probably should say why I specified client-side. I'm being asked to load an extra page into our company website that is supposed to aid some of our employees. I didn't design this extra page, and I was asked to put this up with a very simple log in. Granted I need to confirm with my superior that a client side login is ENOUGH, I just wanted to know if it could be done IF they decide that it's not all that important. The page itself won't have a link on the site, so unless someone knows it's there or decides to snoop, nobody will even know it's there.

Upvotes: 1

Views: 5887

Answers (6)

Phillip Schmidt
Phillip Schmidt

Reputation: 8818

If you think about what "client-side" means, you'll understand why it wouldn't be possible. On the client side, all information is processed and all data is stored on the client's machine. Thus, in order to check passwords totally on the client side, you'd have to have the entire list of usernames passwords saved to every single computer that your site interacts with.

Keep in mind, also, that anything "client side" is inherently less secure than it would be server-side. So even if you could do this, it'd probably be a bad idea.

Now, that being said, here's how you could do it:

Come up with a password (note that you'll have to use a master password, not individual ones), hash the password, and store the hashed password in a variable, or something. It may sound insecure, but if you're hashing the pw, you could send everyone a personalized email with the password and it wouldn't make it any easier to hack. Hashing is a one-way operation. There is no way to reverse engineer it. Do make sure to make your stored password a constant, though, or someone could just change the value of their hashed password last minute to match your stored one. Give the css rule Display:none; to your data with css so that it hides. Now prompt the user for a password. Then, take that password and run it through the same encryption as you did when you created the password. If that value and the one you stored match, bingo. Just revert your display:none; and you're good to go.

Though I guess that still leaves the problem of somebody just firebugging your display:none away. Guess you'd have to encrypt the data on the page too.

Upvotes: 0

Draex_
Draex_

Reputation: 3474

The easiest is probably server side apache authentication. Use these two generators for that: http://www.htaccesstools.com/htaccess-authentication/
http://www.htaccesstools.com/htpasswd-generator/

Just on the client side, using javascript it's never secure enough. But there is way:

if( ​prompt('Enter password'​)​ == 'password' )
{
    // we are okay
}

else
{
    // password is wrong
}​

For more robust example, with username see http://jsfiddle.net/7mZYQ/2/

Upvotes: 1

JorgeeFG
JorgeeFG

Reputation: 5961

You can save your page into a directory protected by .htaccess file.

That would be server side (you have to upload a .htaccess file into the directory).

But client side? Hmmmm the only thing I imagine is to create a DIV with position: fixed that would be over all your page content.

Ask for a user and a password, then check them using Javascript (this is client side), then you add property "display: none" to the DIV that is containing the login view.

That would hide the login view and show the page that is below it.

This is a HUGE security problem in my opinion. I could easily edit your web with Firebug and add Display: none to the div without entering a password.

However, as the password IS in the Javascript I could look at it anyway just viewing the source code.

Upvotes: 2

Arjan
Arjan

Reputation: 9874

No, it cannot be done on the client side. At least not in a secure manner. Client side (password ) validation is very easy to bypass, because clues (such as the password and/or the content you want to show when the correct password is entered) are given to the user.

Upvotes: 0

driangle
driangle

Reputation: 11779

You cannot do this securely only on the client side, it would require you to perform authentication of the user inside the browser. This means your whole userbase would have to be loaded in the browser memory in some form, likely in javascript which makes it unsafe.

For a simple authentication mechanism which involves the server to a minimal extent look at Basic Authentication.

Upvotes: 1

user1189402
user1189402

Reputation:

Well you could try a basic JavaScript dummy with HTML inputs that would somehow offer the slight illusion of password protection. Otherwise, create an HTML form and go with PHP Sessions. These are probably the languages with the most tutorials around so it wouldn't take you that long to pull it off.

Upvotes: 1

Related Questions