Javascript Password Security [closed]

Question

I am having difficulty with the answer provided here, but I couldn't understand how to implement it. My code is pretty much identical:

<script language="javascript">
  function check(form) {
    if(form.userName.value == "User" && form.userPass.value == "averyobviouspassword") {
      window.open('testok/menu.html')
    }
    else {
      alert("Wrong Password Or Username")
    }
  }
</script>

The problem with this is, if you were to Inspect Element on the page, you can plainly see the password. I'm not looking for other solutions like a SQL database, because this is just a test website. The solution I thought might work was this:

if(hash(enteredPassword) == storedHash)

I just don't know how to implement it.

Answer 1

Login pages using JavaScript is actually not advisable. It is totally unsecured. Most of login pages are done in server-side using PHP, ASP.NET, Node.Js, etc. and not in client-side which the code is visible for the users.

Answer 2

I would highly discourage you from doing this in JavaScript on client side.

Even if it is only for testing and learning purpose it is very (very) bad practice! What you are trying to do is, is at best client side verification.

Imagine the following scenarios when you are not using server-side code for verification: Somebody is simple removing this js function when visiting your (test) website. Now all your security is gone. Well it wasn't there in the first place.

Now to your question. If you actually want to use this and not have a plaintext password, you would want to hash it and add salt and pepper. You should use a hashing function which is hard to brute force (here are some examples link)

This is also standard practice for storing passwords in the database.

Here you can see the same problem with your attempt in js. Even if you create the hash and the user could no be figuring the password in reasonable time, there is no security. He can still change the js.

A similar problem occurs when you have the idea of simply sending the hash to the server (without TLS), again bad idea (have a look here link)

So even if it is for testing, for the sake of good practice, just don't. You won't be learning anything valuable form it.

There are plenty of other topic were JavaScript is an excellent tool for getting things done. This is not one of them.

Answer 3

The previous comments are all valid - but if you are just looking to do a bit of obfuscation, you can use base64 conversion functions atob() and btoa(). See below:

<script language="javascript">
  function check(form) {
    if(form.userName.value == "User" && atob(form.userPass.value) == "j÷«Êﬥ«,ÂÝ") {
      window.open('testok/menu.html')
    }
    else {
      alert("Wrong Password Or Username")
    }
  }
</script>

This still uses your original password "averyobviouspassword".