Security issues with .js file

[cthaxter]

I'm wondering what experience people have with .js files and security issues. Is using .js files as opposed to leaving the script in the html files a good way to hide one's script?

I tried downloading someone else's .js file by looking at the source of the webpage, looking at the <script> tag, and typing the proper path into my address bar. It didn't seem to work. That gave me hope that .js files are hidden from the clients; but in searching through all the threads of this forum, I found only one thread that touched on this issue, and it seemed to indicate that clients COULD view .js files.

My first question is: to what extent are .js files safe from general users?

My second question is: what is the best way to hide client-side script from general users?

If server-side script is the best answer to this problem, then it'll have to do... but I'd like to know where client-side script security ends and server-side script security begins.

Thanks.

-Christopher

 

[dianal]

Vieving or not external js files depends on settings of a browser.
NS does not allow to view or download them, but IE does allow download - so you can view the source on your computer.
The trick to download a js file from NS is to have a html file which include a link:
<a href=&quot;

http://sone.com/view.js&quot;>View

it</a>
Look that file in the browser and instead of clicking the link - right click and choose &quot;Save link as&quot; - it will save wanted js on your hard drive.
Most users know similar tricks, so the included js are not secure.

 

[UNIMENT]

Somebody sure doesn't seem to understand the &quot;hide.&quot;

As far as I know, there are no security issues with loading an external script. You can even load scripts across domains.

You're probably doing something wrong when declaring your script tags.
[COLOR=aa0000]

<script type=&quot;text/javascript&quot; src=&quot;myScript.js&quot;></script>
<script type=&quot;text/javascript&quot;>
// Code in the webpage
</script>

[/color]

The main problem that I've seen people run across while including an external script happens when they attempt to put code inside the <script> tag that includes the external file. If you include an external script, any code within the <script> tag will not be executed, while the code from the external script will be executed.

- UNIMENT

 

[xutopia]

you could use obfuscating techniques such as scramblers (little programs that make your JS code smaller and changes the names of all functions like Jmyth).

However I wouldn't count on Javascript for security. It wasn't meant to be just that. If you want password protection or something similar I recommend PHP or Java (PHP is easy to learn and implement almost anywhere, java although easy to learn takes a bigger setup to run).

If you simply want to protect your code from copying, put a copyright notice and sue the pants off whoever copies your code. But in most cases javascript code is so darn simple that having a copyright on it is like trying to copyright the phrase &quot;Did I do that?&quot; as a trademark.

Microsoft did come out with a script encoding (supported by Internet Explorer only) but there exist all kinds of cracks to read those scripts and is thus not a viable solution for securing important information.

My rule of thumb : don't spend time hiding JS code. If code needs to be hidden server side code is better.

Gary &quot;

http://www.xutopia.com&quot;

Haran