CODEWITHSUNDEEP
javascripthtmlsecurityhttp-error
user3213765
user3213765

Reputation: 87

Why does this link to a JS file return Unauthorized, but it works in HTML?

Is it possible to not allow people view one of my website's JS file?

Demo: http://js.maxmind.com/js/geoip.js

If you copy the URl and paste it in the browser, it will say "Unauthorized". But if you put it inside the HTML, it will do it's work.

Can I do that with my code.js file?

Upvotes: 3

Views: 1321

Answers (4)

Itay Gal
Itay Gal

Reputation: 10824

JavaScript is an interpreted computer programming language. It's not being compiled and it runs on the client's browser/computer, therefore, the client must see the script in order to execute it. That's why you cannot hide the code.

You can define in your server folders as restricted and that means the user can not access them directly, but when the browser loads the page it have to load all the components such as images, css files, js files etc... If the browser can load them, it means the user can see them as well.

For example, you can also define that users are not authorized to see any .jpg files but they can easily save any image. Actually the browsers usually saves the images anyway on your local computer and cache them, so next time you load the page, it won't have to download files that weren't changed again.

As others already mentioned, trying to hide a js code is very bad practice and you need to avoid it. If you want the make the life hard for other developers that wants to copy your code you can use this site to obfuscate your js code, but remmeber, it only makes it harder to read by humans, it does not provide you any security.

Upvotes: 5

user1618236
user1618236

Reputation:

Although you cannot prevent a user from being able to look at your javascript you can make it extremely difficult for them to understand what they are looking at through obfuscation or minification, for the latter there are many services that will do this for you; look at this for example. As for obfuscation I don't know of any way to do it automatically but it would be a similar approach.

If you have information in the javascript that you truly cannot allow a user to see, then I would suggest moving it into the server side code and only pass to the javascript the absolute minimum. As I am not sure what you are using on the server side I cannot give you a specific example; however in the past when using MVC I achieved this by passing the values I needed either to a hidden input ( if the value needed to be posted back with a form) or through jQuery.Data

Upvotes: 1

djechlin
djechlin

Reputation: 60788

First, let me explain loud and clear: that is the worst security I can imagine for what it is trying to do. It is just shouting, "HEY NOBODY LOOK AT THIS INSECURE FILE."

Your question has been viewed 41 times so far. That means up to 41 people are wondering what that mysterious does and probably half of them can find easily out. In short, don't do this.

There is no client side security. I refer you to this answer, for instance.

As for how to implement the situation, as noted in comment it's probably done by checking the referrer header. To find out fully check the request headers in the dev tools in your browser and compare to the request headers used by curl (e.g. by using a post bin).

Upvotes: 3

Oswald
Oswald

Reputation: 31685

It is not possible to not allow people to view one of your website's JS files.

To be more precise, if someone can execute your JS file, they can view it.

Upvotes: 2

Related Questions