如何密码保护静态网站？ （没有htaccess）
我有一个静态网站，我想使用一个用户名和/或密码（如Apache的HTACCESS确实可以保护），但我不想托管Apache Server供其正常工作。如果没有前端JavaScript，我该如何实现？
我使用前端JS的最接近（因为可见源太不安全）：
<!DOCTYPE html>
<html lang="en">
<script>
var password = "password";
(function promptPass() {
var psw = prompt("Enter your Password");
while (psw !== password) {
alert("Incorrect Password");
return promptPass();
}
}());
alert('Correct Password\nWelcome!');
</script>
<body align="center">
<h1>Password Protected Site</h1>
<!-- Other page elements -->
</body>
</html>
I have a static website that I want to protect with a username and/or password like apache's htaccess does but I don't want to host an apache server for it to work. How can I achieve this without frontend javascript?
The closest I've come using frontend JS (too insecure because source is visible):
<!DOCTYPE html>
<html lang="en">
<script>
var password = "password";
(function promptPass() {
var psw = prompt("Enter your Password");
while (psw !== password) {
alert("Incorrect Password");
return promptPass();
}
}());
alert('Correct Password\nWelcome!');
</script>
<body align="center">
<h1>Password Protected Site</h1>
<!-- Other page elements -->
</body>
</html>
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
默认情况下，必须在后端上完成安全性（正如其他人已经说明的那样）。
但是我想到了一件事是在前端进行一些安全性：
使用一些JavaScript从用户请求Passwort，并使用此密码解密已交付的页面中已经可用的一些加密字符串，并替换
body与解密数据的内容。应该有一些库使用JavaScript加密/解密数据。By default security has to be done on the backend (as already stated by others).
But one thing came to my mind to do some security on the frontend:
Use some JavaScript to request a passwort from the user and use this password for decrypting some encrypted string already available within the delivered page and replace the
body's content with the decrypted data. There should be some libraries available for encrypting/decrypting data using JavaScript.据我所知，前端的任何东西总是可以看到的。因此，要密码保护静态HTML页面，您应该密码保护文件本身，否则您应该在此页面重定向的页面中提示一个密码。
As far as I know, anything that goes to frontend will always be visible. so to password protect a static html page you should password protect the file itself or you should prompt for a password from the page where this page is redirected.
我认为从技术上讲，您可以没有服务器以进行安全性逃脱。概念验证思想实验...如果页面的整个HTML内容都是可读但加密的，并说用户必须将解密密钥输入弹出窗口，那么从理论上讲，顾客端JavaScript可以解密页面内容，不可避免。
唯一的问题是每个用户的密码将是相同的密码，除非您可以做些聪明的事情。
I think technically you can get away without a server for security. Proof-of-concept thought experiment... if the entire HTML content of the page was readable but encrypted, and say a user had to type the decryption key into a popup, then in theory client-side JavaScript could decrypt the page content, without being circumventable.
Only issue is it would be the same password for every user, unless there is something clever you can do about that..
如果我必须在这些条件下提出某些内容，我会考虑使用Hashing用户名和密码的内容，并将其用作服务器上包含页面实际内容的文件的URL，然后使用JS加载它。
但是，如果您实际关心安全性，而不仅仅是要使大多数用户具有挑战性，那么在后端上进行安全性是一个更好的选择。
If I had to come up with something under these conditions, I'd be thinking of something along the lines of hashing the username and password and using that as the url for a file on the server that contains the actual content of the page and then using JS to load that in.
But still, doing the security on the backend is a much better option if you actually care about security and not about just making it challenging for most users.
据我所知，您至少需要一点JS，因为HTML根本没有任何逻辑构造来完成您需要的工作。如果您真的想保持它静态，我会使用强的JS obfuscator，例如 obfuscator.io 。
As far as I know, you will at least require a little JS since HTML simply doesn't have any logic constructs to accomplish what you need. If you REALLY want to keep it static, I would go about it by using a strong JS obfuscator, such as Obfuscator.io.