密码保护 HTML5 离线应用程序目录
我有一个能够离线运行的 HTML5 应用程序。但是，我需要用密码保护该应用程序所在的目录，以仅允许授权用户访问。最初我使用 PHP 登录页面，该页面设置一个 cookie（在应用程序目录之外），然后重定向到应用程序目录。应用程序 (JavaScript) 检查 cookie，如果存在，则允许用户运行该应用程序。如果没有，它将它们重定向回应用程序目录。
此方法的问题是，如果直接引用（我不希望这样做），目录中的所有文件仍然可以访问。我不希望用户每次访问目录时都必须进行身份验证（这是一次性身份验证过程；cookie 就在那里，这样他们就不必再次输入用户名/密码），而且我还希望有一个风格化的登录表单（即不使用默认浏览器登录框进行http 身份验证）。
最后，因为这是一个离线 HTML5 应用程序，所以我无法在应用程序本身中包含任何 PHP 代码。
有什么建议吗？
I have an HTML5 app which is capable of running offline. However, I need to password protect the directory this app resides in to only allow access to authorized users. Initially I was using a PHP login page which set a cookie (outside of the app directory) then redirected to the app directory. The app (JavaScript) checks for the cookie and if it's there it lets the user run the app. If not, it redirects them back out of the app directory.
The problem with this method is that all of the files in the directory are still accessible if referenced directly (which I don't want). I do not want users to have to authenticate every time they hit the directory (it's a one-time authentication process; the cookie is there so that they never have to type their username/password again), and I also want to have a stylized login form (i.e. not using the default browser login box for http authentication).
Finally, because this is an offline HTML5 app, I can't include any PHP code in the app itself.
Any suggestions?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这听起来不像是你可以用 Javascript 做的事情。该脚本需要访问文件系统才能限制对文件夹的访问，不是吗？
除非浏览器通过 javascript API 公开此功能，否则我认为这是不可能的。听起来这将是一个有用的功能。
也许您可以加密重要数据，但除了减慢应用程序速度之外，我不确定它会有什么好处，因为所有必要的密钥也必须存储在本地......
由于安全的一般规则web 的特点是，如果没有在服务器端进行双重检查，你永远不能依赖客户端发生的任何事情（例如在 Javascript 中），当应用程序离线运行而服务器端不运行时，这当然会带来问题。可用:(
看看“如果cookie存在则进行Javascript重定向”问题，除非我弄错了，否则恶意用户编辑Javascript（例如使用Firebug）在任何情况下进行重定向都是微不足道的。
编辑：通过顺便问一下，您正在寻找什么级别的安全性？“妈妈将无法意外访问我的帐户”级别（听起来您已经实现了），或者“除了国家安全局之外，没有人应该这样做”能够破解它”级别吗？
That doesn't sound like something you could do from Javascript. The script would need access to the file system to be able to restrict access to the folder, wouldn't it?
Unless this feature is exposed by the browser via a javascript API, I don't think it will be possible. It sounds like it would be a useful feature though.
Perhaps you could encrypt vital data, but apart from slowing down the application, I'm not sure what good it would do, since all the necessary keys would have to be stored locally as well...
Since the general rule of security on the web is that you can never ever rely on anything that happens client-side (e.g. in Javascript) without a double check on the server-side, this will of course pose a problem when the app is running offline and the server-side is not available :(
Looking at the "make Javascript redirect if the cookie exists" problem, unless I'm mistaken, it would be trivial for a malicious user to edit the Javascript, using for example Firebug, to redirect in any case.
EDIT: By the way, what level of security are you looking for? The "mom won't be able to accidentally access my account"-level (which it sounds like you already achieved), or the "no one, except maybe the NSA, should be able to hack it"-level?