Html Block Page Even When Directly Opened
Hello I Am Making My Own Webpage, Its in Html. Now My Question Is That I Have an Media. Html Page That Is in an Speparate Folder Called Protection. by the Menu...
Hello I am making my own webpage, its in html.
Now my question is that i have an media.html page that is in an speparate folder called protection.
by the menu entry i have it routes trough a java script to promt for a password. After the correct password is put in it will route you to the page in the protection folder.
But when you put in the direct link to the page (left out the real domain). the page is loaded without asking for a password.
the script
<SCRIPT language="JavaScript">
<!--hide
var password=prompt('Enter the password:','');
var mypassword="2Wsxxsw2";
if (password==mypassword)
{
window.location="/protection/media.html";
}
else
{
window.location="/protection/mediaUP.html";
}
//-->
</SCRIPT>
is there a way to protect the page even when you go to the direct file.
It runs on an server 2012 R2 IS 8.5 web server.
2 Answers
You need to:
- Perform the authorization check on the server (i.e. to not use client side JavaScript for this)
- Perform the authorization check for every page that requires authorization
Your current approach is effectively to throw a tarpaulin over the door to your secret room and stand a bloke outside holding a clipboard with instructions to him which say "If anyone says 2Wsxxsw2, point them under the tarp" (and anyone can look over his shoulder to read the clipboard).
Yes, this is possible, but not with JavaScript. In your example I can just open source of page and see password and correct URL.
You can protect this folder by web server settings. I'm not expert in IS but I think there is not problem. Just search how protect folder in IS web server.
Sophia analyzes international trade, startup ecosystems, retail transformation, and supply chain logistics for modern digital publications.
