1

I am having difficulty with the answer provided here, but I couldn't understand how to implement it. My code is pretty much identical:

<script language="javascript">
  function check(form) {
    if(form.userName.value == "User" && form.userPass.value == "averyobviouspassword") {
      window.open('testok/menu.html')
    }
    else {
      alert("Wrong Password Or Username")
    }
  }
</script>

The problem with this is, if you were to Inspect Element on the page, you can plainly see the password. I'm not looking for other solutions like a SQL database, because this is just a test website. The solution I thought might work was this:

if(hash(enteredPassword) == storedHash)

I just don't know how to implement it.

  • 4
    The short answer is all client-side code is inherently insecure, which is why all authentication and verification has to be done server-side. That's not really a Javascript issue though; your server-side code could be node.js or ASP.NET or any myriad of languages or frameworks. – Ixrec Aug 1 '15 at 1:07
5

Login pages using JavaScript is actually not advisable. It is totally unsecured. Most of login pages are done in server-side using PHP, ASP.NET, Node.Js, etc. and not in client-side which the code is visible for the users.

  • Would there be anyway of doing it client side though, like I said in the OP question, it's purely a test website, and I don't want to be doing server side scripting to make it work. This website is run throughout the home, no where else. It'd be too much an effort in order to make a password protected page, using server side scripting. Thanks for trying to help, but it's not exactly what I was looking for. – Stephen Aug 1 '15 at 3:26
  • Sorry, well the answer for your question is "There is no other solution fixing this problem only using JavaScript." – 4ldrich Aug 1 '15 at 3:57
  • But you may try this, css-tricks.com/… – 4ldrich Aug 1 '15 at 3:57
  • @Stephen In principle all you can do on the client is obfuscate the password checking code, and if this is for personal use you probably aren't worried about your clients attacking you (themselves?), so I doubt there's anything worthwhile you can do on the client. If you have a server, an external attacker can always send arbitrary data to your server without using your client, so anything remotely resembling security has to happen in server code. If there is no server, then...there's not much in need of securing. – Ixrec Aug 1 '15 at 10:37
  • @4ldrich I'll try that method soon. I tried a live demo, and it really looks quite promising! – Stephen Aug 1 '15 at 10:45
2

I would highly discourage you from doing this in JavaScript on client side.

Even if it is only for testing and learning purpose it is very (very) bad practice! What you are trying to do is, is at best client side verification.

Imagine the following scenarios when you are not using server-side code for verification: Somebody is simple removing this js function when visiting your (test) website. Now all your security is gone. Well it wasn't there in the first place.

Now to your question. If you actually want to use this and not have a plaintext password, you would want to hash it and add salt and pepper. You should use a hashing function which is hard to brute force (here are some examples link)

This is also standard practice for storing passwords in the database.

Here you can see the same problem with your attempt in js. Even if you create the hash and the user could no be figuring the password in reasonable time, there is no security. He can still change the js.

A similar problem occurs when you have the idea of simply sending the hash to the server (without TLS), again bad idea (have a look here link)

So even if it is for testing, for the sake of good practice, just don't. You won't be learning anything valuable form it.

There are plenty of other topic were JavaScript is an excellent tool for getting things done. This is not one of them.

  • @ecarrizo JavaScript itself is not the problem, but the way OP is using it, implies client side. – John Aug 1 '15 at 18:19
  • Sure, I've add the comment in order to make it clear :) – ecarrizo Aug 1 '15 at 18:29
0

The previous comments are all valid - but if you are just looking to do a bit of obfuscation, you can use base64 conversion functions atob() and btoa(). See below:

<script language="javascript">
  function check(form) {
    if(form.userName.value == "User" && atob(form.userPass.value) == "j÷«Êﬥ«,ÂÝ") {
      window.open('testok/menu.html')
    }
    else {
      alert("Wrong Password Or Username")
    }
  }
</script>

This still uses your original password "averyobviouspassword".

Not the answer you're looking for? Browse other questions tagged or ask your own question.