Member Avatar for Big Riv

I am experiencing a great degree of difficulty trying to password protect a page on my site. I have a .txt file of user id numbers which serve as passwords, and I want to create a java script to gain access that file from my html form. Any help out there?

  • 4 Contributors
  • 5 Replies
  • 421 Views
  • 1 Year Discussion Span
  • Latest Post Latest Post by Troy

Dani AI

Generated

This thread shows the core problem clearly: a browser-visible text file plus client-side JavaScript cannot keep secrets. Building on suggestions from and , here are two practical, safe options (pick the one that fits your hosting) plus small, ready-to-use patterns and precautions that were missing from the original replies.

First, webserver-level protection (best for static files). On Apache put an .htaccess in the folder you want to protect:

AuthType Basic
AuthName "Restricted Area"
AuthUserFile /home/youruser/.htpasswd
Require valid-user

Create .htpasswd entries with htpasswd (or an online generator if you lack shell access). This keeps authentication out of your application and protects PDFs/images directly.

Second, app-level protection (best for dynamic sites or when you must control access per-user). Store credentials hashed (never plaintext) and authenticate on the server; keep protected files outside the webroot and stream them after verifying a session. Minimal PHP patterns:

/* login.php */
session_start();
$stmt = $pdo->prepare('SELECT id,password_hash FROM users WHERE username=?');
$stmt->execute([$user]);
$row = $stmt->fetch();
if ($row && password_verify($pass, $row['password_hash'])) {
  session_regenerate_id(true);
  $_SESSION['uid']=$row['id'];
  header('Location:protected.php'); exit;
}
/* fetch.php (serve protected file) */
session_start();
if (!isset($_SESSION['uid'])) { http_response_code(403); exit; }
$path = __DIR__.'/../private/'.basename($_GET['file']);
if (is_readable($path)) {
  header('Content-Type: '.mime_content_type($path));
  header('Content-Length: '.filesize($path));
  readfile($path); exit;
}

Practical cautions and missing details from earlier posts: always use HTTPS, use prepared statements and password_hash/password_verify, sanitize filenames to avoid traversal, place credential stores outside webroot, set secure cookie flags and session timeouts, and check webserver settings (AllowOverride, IIS authentication) before deploying. If staying with Access/ASP as suggested, apply the same rules: hashed credentials and server-side checks rather than exposing a plain .txt to the client.

Recommended Answers

All 5 Replies

Member Avatar for suRoot

it's much much much easier to use an access database.. ive got the asp code for this (you're using cookiebased login sessions yea?) but i would need t find it, ask m again if you acctually want it

Member Avatar for Big Riv

OK, I will try using the Access Database.. I could still use your help though. Just let me know what I need to send you and I'll get it done.

Member Avatar for Troy

Password protection can be tackled a lot of different ways and they depend on:

  • Which OS (windows? linux?)
  • Which webserver (IIS? Apache?)
  • Do you have admin privs on the server?
  • Do you only need to protect scripts or all files?
  • What scripting languages are available to you? (ASP?, ASP.NET?, PHP?, Java?, PERL CGI?)

Know that you cannot secure any web page with javascript. You can make a page harder to access for somebody without any HTML/script skills, but not secure.

You mention a text file with the passwords that the javascript will use to verify....um....if your client-side javascript can access the text file, so can your site visitors. All they have to do is open the page source, read the javascript, then point their browser to the text file. Again, not secure.

Member Avatar for Comatose

Best way is to use a server side language, like Perl or PhP (or ASP), and use it for the authentication...

Member Avatar for Troy

I don't know that I'd say using a server-side scripting language is the "best" way. You can certainly build a good solution that way. I provide a PHP example for password-protecting pages in my class_session.

I would argue that as far as security goes, using a method natively supported by your webserver is even better than using server-side script. You can configure the webserver to require authentication for specific files or directories. This is done by turning off anonymous access and configuring an authentication method.

For example, with Apache, you can have Apache require the user to authenticate using an OS account, an htpasswd account, or a user account stored in a database. You can enforce this using the Apache conf files or via .htaccess files -- you can search for more about .htaccess.

With server-side script, typically you can only protect script. For example, if you have a directory full of PDF's, it's not so easy to protect those with server-side script. There IS a way, but it involves storing the PDF's in a non web-accessible directory and having a script that can open and stream the PDF--if the user is authorized.

It really depends on what your goals are, what your platform is, and what skill resources you have available.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.