On a project I am working on I have all javascripts mixed together in all.js. I have a separate file, admin.js that contains scripts used on the admin section of the project. This file is only included when browsing the admin section.

Is there any security risks involved in having admin.js together with all other assets? Meaning that it is publicly available, if you know where to find it.

It does not contain any usernames or password. And it only makes calls to urls protected by admin middleware.

  • If you can't access anything without credentials, I guess it doesn't matter. – John Feb 26 '16 at 22:47
  • 2
    To avoid confusion, use "javascripts" instead of "java scripts". – user1751825 Feb 27 '16 at 0:37

There's no security risks associated with including everything in a single file. This is typically what web optimizers do anyway.

Whether it's safe to allow public access to admin scripts though, depends on what's in them. You've mentioned you don't store credentials in there, so it shouldn't be a security risk. However you may potentially have intellectual property that you'd prefer your competitors don't get access to. In this case you could potentially protect them in the same way as the rest of the admin only content.

| improve this answer | |
  • Good point with the intellectual property. – Thomas Jensen Feb 27 '16 at 9:18

The only question is, why?

Bundling the scripts will provide the additional JavaScript in every download to the site, even though only Administrators will use that portion. And, while there may be negligible security concerns due to the middleware layer, is the savings of moving it down to one file enough to justify the risk?

I suppose the justification will belong to you, but on it's face, I'd leave them in separate files.

Also, I second user1751825's comment - they are files of JavaScript, not Java Scripts. :)

| improve this answer | |
  • As I write in my question; the admin.js file is only loaded with pages in the admin section. I want to put this file on our CDN. Agree with the jacascript comment :) – Thomas Jensen Feb 27 '16 at 9:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.