javascript - Make text difficult to parse by automated means -


i need include small javascript snippet on single-page web-application serves content-protection mechanism subsequent ajax-requests:

javascript

<script>     dr.token.id = random_hash </script>

this protection has flaw: trivially easy machine extract random_hash part of snippet.

to counter this, use simple server-side script add noise snippet, resulting in varying versions of:

document.write("<scr" + "ipt>dr.toke" + "n.id" + " = " + "\"rando" + " + "m_hash\"</" + "script>" document.write("<s" + "cript>dr.t" + "oken.id" + " = " + "\"ran" + " + "dom_hash\"</scri" + "pt>" ...

however, more complex regex extract random_hash once again.

i'd prefer not use on-the-fly obfuscator, since performance vital. there reliable solutions make difficult machines extract random hash without significant effort on part?

i'm not concerned machines capable of running javascript code achieve extraction, intend deter average joe writing trivial script harvest application's data.

you must recognize nothing on web page secure snooping. best can hope defeat naive hacking techniques. extent, "add noise" approach sound. yes, can hacked "slightly more complex regex", how attacker know which regex might be? take analyzing source, mind qualifies significant effort.

if give added (but false) measure of security, can base-64 encode (off line) arguments document.write() , decode them on fly. don't think have performance impact. (calling document.write() would, think, swamp decoding overhead.) insulate sensitive info human casually reading page source. so, instance, base-64 encoding of

<script>dr.token.id = random_hash</script>

is

phnjcmlwdd5eui50b2tlbi5pzca9ifjbtkrptv9iqvnipc9zy3jpchq+

so document contain:

document.write(frombase64('phnjcmlwdd5eui50b2tlbi5pzca9ifjbtkrptv9iqvnipc9zy3jpchq+'));

where frombase64() base-64 decoder.


Comments

Post a Comment

Popular posts from this blog

c++ - Difference between pre and post decrement in recursive function argument -

i have following sample code used pre-decrement void function(int c) { if(c == 0) { return; } else { cout << "dp" << c << endl; function(--c); cout << c << endl; return; } } this function give output input 4 : dp3 dp2 dp1 dp0 0 1 2 3 but when use post decrement void function(int c) { if(c == 0) { return; } else { cout << "dp" << c << endl; function(c--); cout << c << endl; return; } } output goes in infinite loop dp4 can explain me in detail why happens ? this happens because function(c--) called same value of c , when finishes c decremented. recursively called, hence called same value no chance of return , hit stack overflow error. assume this, int x = 1, y = 0; y = x++ result y == 1 , x == 2. if y = ++x , bot x , y 2.
Read more

php - Nothing but 'run(); ' when browsing to my local project, how do I fix this? -

i added new project. made mistake in projectname.conf file in sites-available apache2, led me reinstalling apache2. after reinstalling , re-enabling projects on every page of every project .. <body> run(); </body> .. i've run composer update, restarted service, restarted pc, checked config files, tried disabling new project. there nothing in error log, , access.log: 127.0.0.1 - - [15/may/2015:01:40:47 +0200] "get / http/1.1" 304 181 "-" "mozilla/5.0 (x11; ubuntu; linux x86_64; rv:38.0) gecko/20100101 firefox/38.0" maybe i'm forgetting apache2 reinstall? don't think did different last time installed it. looks haven't setup php correctly. take @ this great guide , maybe you're forgetting link php config apache2.
Read more

php - How can I echo out this array? -

i don't know how go grabbing data in variable , put foreach loop. class tree{ private $info = array( array('name'=>'jim','state'=>'nu','company'=>'nu','phone'=>array('cell'=>'5615111111','office'=>'5611111111'),'email'=>array('primary'=>'exs@example.com','ex@there.com')), array('name'=>'joe smith','city'=>'phoenix','phone'=>'4805551111','email'=>'jsmith@some_email.com'), array('name'=>'john doe','city'=>'chandler','company'=>'doe co.','email'=>array('jdoe@gmail.com','personal'=>'email@email.com'),'phone'=>'6025550002') ); } if you're inside of class, can access private variable using $this->variablename . example, i...
Read more