Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
HomeAnnouncementsWhite Papers
Discussion GroupsFirst AidDatabasesJavaBeansGUIJava 3DVirtual MachineCORBASecurityToolsGeneral
Java DirectoryOpen Source ProjectsSample Book ChaptersUser GroupsWeb Resources
Related Topics
Databases.NETMore Topics ...

Java Forum / General / November 2006

Tip: Looking for answers? Try searching our database.

security, jsp, ajax, how to hide the URL or the javascript.js in web container

Thread view: 
John_Woo - 07 Nov 2006 16:03 GMT
Hi,

We are going to apply AJAX and struts in a web app. One thing we have
to concern is the security issue.

let's say we put the javascript.js in a folder where jsp can load, and
then specify the url in the javascript; but user can view the jsp via
web-browser's view source function, thus he/she can load the javascript
file as well, namely the url inside the javascript is no way to hide.

Can anyone have idea on this?

--
Thanks lots
John
Toronto
Chris Uppal - 07 Nov 2006 16:27 GMT
> let's say we put the javascript.js in a folder where jsp can load, and
> then specify the url in the javascript; but user can view the jsp via
> web-browser's view source function, thus he/she can load the javascript
> file as well, namely the url inside the javascript is no way to hide.
>
> Can anyone have idea on this?

Yes.  Don't even think about trying to prevent people reading your client-side
JavaScript.  It is intrinsically open, and if your application's security
depends to the slightest extent on the users not being able to see, read, or
manipulate that (or anything else sent between browser and server) then your
application is /VERY SERIOUSLY/ broken.   (In the sense of "sack the designer
instantly for gross professional negligence").

Of course, you may only want to hide this stuff to stop users being /tempted/
to meddle (even though they wouldn't be able to break anything important if
they did try it).  If so then that's perfectly reasonable -- but I can't tell
you how to do it.  Indeed, I doubt it if is possible -- if the user has enough
smarts to meddle in the first, then they'll quite probably have configured
their browser to ignore anything you can do to make it difficult.

   -- chris


Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...

Oracle MagazineNetwork ComputingComputer WorldBio-IT WorldeWeekInformation WeekInfosecurity
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.