A more lightweight solution would be to hash the password and have a copy of that file at this url. windows.location = hash(password);
Their solution intends for the static file to be copied offline
Password protect a static HTML page
21–30 of 294 posts
Re: Password protect a static HTML page
#22Re: Password protect a static HTML page
#23Earlier quoted context omitted.
I think your definition of a static web page is different from the common one? In my head, a static page is something that's served verbatim, without some backend generating it or inserting things into a template. Wikipedia seems to agree with that view: https://en.wikipedia.org/wiki/Static_web_page
That's exactly what I said. It doesn't matter if I wrote the HTML by hand or I had a perl, or bash, or compiled c program make it. It's just an HTML file.
[deleted]
Re: Password protect a static HTML page
#24A more lightweight solution would be to hash the password and have a copy of that file at this url. windows.location = hash(password);
Client side decryption has the benefit that no machine or router in the middle can view or cache the decrypted page without the password.
Re: Password protect a static HTML page
#25Should have used the WebCrypto API instead of the crypto-js npm package. https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_...
I spent some time Googling this about 6 months ago. Lots of tutorials on Crypto-js, not so many (and almost zero "here's a super simple implementation") for WebCrypto API. I can understand if this is a hobby project why you'd lean into one rather than the other, I probably would have done the same.
Re: Password protect a static HTML page
#26If you have to run javascript it is not a static page anymore. I've seen a lot of this particularly weird overloading of "static HTML" lately. Static HTML, or static webpage, is meant to describe the experience from the person who is trying to look at the page. It does not describe the experience of the dev. Using a dynamic script or application to generate a static html page that requires no JS execution is a static…
You're interpreting the title as "a static HTML page with password protection", but the way I understood it is "statically hostable version of a static HTML page with password protection", which seems to be exactly what this implements. I'm probably biased because I would have frequently had use for this, and all the paid offerings mention "private hosting of static pages", but I feel you're a bit uncharitable with your interpretation.
If you want to just have a free small private static page which is easily updated by public CI offerings this is a great solution, and the title transports this clearly.
Re: Password protect a static HTML page
#27A more lightweight solution would be to hash the password and have a copy of that file at this url. windows.location = hash(password);
Wow I like that. So simple and elegant. Could be combined with a username to produce unique urls per user.
A miss configured http server that allows directory listing would compromise everything.
Also now all intermediate things that have access to the hashed url would suddenly have access to a secure piece of information.
Don’t be clever with security
Re: Password protect a static HTML page
#28Anyone remembers .htaccess files from Apache? Good times.
Those would be quite nice, if web browsers were good HTTP clients. The user experience with basic auth is not so good. The dialogs give little way to customize and providing information for user. No support for logout or any form of password changes.
Isn't that sort of a feature? Customizable HTTP auth dialogs are a security liability, as they blur the line between content and browser.
Re: Password protect a static HTML page
#29Earlier quoted context omitted.
I think your definition of a static web page is different from the common one? In my head, a static page is something that's served verbatim, without some backend generating it or inserting things into a template. Wikipedia seems to agree with that view: https://en.wikipedia.org/wiki/Static_web_page
That's exactly what I said. It doesn't matter if I wrote the HTML by hand or I had a perl, or bash, or compiled c program make it. It's just an HTML file.
Lol no. If you HTML is generated, it's by definition not static anymore.
Otherwise, all of the React server side rendering is static HTML.
Re: Password protect a static HTML page
#30Earlier quoted context omitted.
I think your definition of a static web page is different from the common one? In my head, a static page is something that's served verbatim, without some backend generating it or inserting things into a template. Wikipedia seems to agree with that view: https://en.wikipedia.org/wiki/Static_web_page
That's exactly what I said. It doesn't matter if I wrote the HTML by hand or I had a perl, or bash, or compiled c program make it. It's just an HTML file.
You're incorrect
CSS and JavaScript and images are also static, it doesn't have to be just HTML
If you have a perl or bash or c backend generating html in response to http requests it's not static