0

I want to make a static webpage, but secure it with a login.

In order to do this, I looked at this link. Basically, I want users to log in their Google account to be able to view the webpage.


But I don't understand how this is secure. Client load the whole webpage, so he can access the javascript. He will see which URL is redirected after Google login. Can't he just copy this URL directly, therefore accessing the page without logging to Google ?

1

You cannot make a static page secure with client side scripting. It's impossible. You have to have some server side component that validates the user credentials.

Remember that the user has full access to modify any code running in their browser, and can manipulate it at will.

You can do your OAuth authentication in Javascript, and hand the acquired Token over to a server side script that validates it against google, and if validation is OK, hands out the secure content. All the authentication would still happen client side, and only the access token would leave the client, but the verification would be done server side.

1

Client-Side is never secure. You have to implement a way for the server to differentiate between authorized and unauthorized users.

For this, you need some server-side logic, which goes more into the realms of programming than information security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.