a security type question

vaska

i'm not sure where i should ask this...so i thought i would venture here...

here's the deal. i have a javascript file that contains a whole mess of functions for a specific page on a site. now, i would like to keep these functions secret.

obviously, anybody can call up and view a javascript file. but i'm wondering if it was really a php file (like stuff.js.php) that was both outputting the text file javascript stuff and also had some security code in it such that if a person tried to view it directly, a script would catch that the referrer was not one specific page and therefore not show them the javascript...

does that make sense? it's just an idea that popped into my head. i'm not sure if this would be prudent or not. and if i can't secure the page in mention, i'm not bothered by that either...

EDIT: seems to work very nicely, but I'm not sure about just how reliable the referrer information would be. if it worked 95% of the time i think it would be worth it. and i wonder how easy it would be to spoof, but hackers would have to guess as to what i've done with the string and how i did it...not such an easy task i believe...

thoughts?

goldbug

Does this file ever live in a browser cache???

If so, it's trivial to pull the cached file up and look at it.

vaska

oh yeah, that...

i can't seem to figure out how to get at the cache's anymore...hmmm...

well, it was an idea, like i said...

debunked...v

AstroTeg

Mozilla users have access to a JavaScript debugger which may be able to pull up your file and its contents. But I'm not sure if it works off of a cached version or a fresh copy delivered from the server.

Personally, if you're sending it to the browser, its going to be available to grab by those who want it. How difficult you want to make it is up to you and how much time you have on your hands...

planetsim

Possibly for protection actually make it have a .php extention, and then use headers to make it javascript. Of course before the headers you can do some security measures if the user has tried to access it be itself etc.

Weedpacket

Whether it (the Mozilla JS Debugger) uses a cached version of the page or not is pretty much moot: if it does have to make a fresh request it - well, the server will just serve it up again.

To rephrase what Astroteg said: once it's on their machine at all it's out of your control.