Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password protect a static HTML page

github.com

Post reply on HN
Print view View original

51–60 of 294 posts

Re: Password protect a static HTML page

#51

Post by cgb223 »

iamben wrote: post #25
realPubkey wrote: post #15

Should have used the WebCrypto API instead of the crypto-js npm package. https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_...

I spent some time Googling this about 6 months ago. Lots of tutorials on Crypto-js, not so many (and almost zero "here's a super simple implementation") for WebCrypto API. I can understand if this is a hobby project why you'd lean into one rather than the other, I probably would have done the same.

Sounds like a golden opportunity for someone with a developer blog to make useful content

Re: Password protect a static HTML page

#53

Post by Karellen »

superkuh wrote: post #3

If you have to run javascript it is not a static page anymore. I've seen a lot of this particularly weird overloading of "static HTML" lately. Static HTML, or static webpage, is meant to describe the experience from the person who is trying to look at the page. It does not describe the experience of the dev. Using a dynamic script or application to generate a static html page that requires no JS execution is a static…

I think "static" and "dynamic" can reasonably be used to describe both server-side and client-side behaviour, and I don't think that the dual meaning is particularly new.

Yes, "Dynamic HTML" vs "Static HTML" to refer to JS-dependent and JS-free pages respectively has been around since the dawn of javascript, but my copy of the 1996 O'Reilly CGI Programming on the World Wide Web by Gundavaram contains sentences like

"Virtual, or dynamic, document creation is at the heart of CGI" (p.4)

"A common use for [server redirection] is to return a generic document that contains static information. [...] Suppose you have an HTML file (thanks.html) like the one below, that you want to display after the user fills out one of your forms: [...] You could use the programs discussed earlier to return static documents, but [...] it is much quicker and simpler to [redirect with a "Location" header]." (pp.44-45)

...without mentioning javascript anywhere.

Re: Password protect a static HTML page

#54

Post by Kiro »

superkuh wrote: post #41
meghan_rain wrote: post #29

Earlier quoted context omitted.

Lol no. If you HTML is generated, it's by definition not static anymore. Otherwise, all of the React server side rendering is static HTML.

Oh, so when I make an .html file in Dreamweaver WYSIWYG HTML editor and save the .html file to my websever ~/www/ dir it is automatically not a static page anymore because I used a program to generate it? This is a very wild and weird interpretation of 'static site' that does not fit with existing usage.

You are the last person to have a say in that considering your incorrect take that JS can't be static. You're clearly misaligned with common usage of terms.

Re: Password protect a static HTML page

#55

Post by trusz »

iamben wrote: post #25
realPubkey wrote: post #15

Should have used the WebCrypto API instead of the crypto-js npm package. https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_...

I spent some time Googling this about 6 months ago. Lots of tutorials on Crypto-js, not so many (and almost zero "here's a super simple implementation") for WebCrypto API. I can understand if this is a hobby project why you'd lean into one rather than the other, I probably would have done the same.

Not going to pretend that I know what the most of the stuff mean, or if it is even safe enough, but I've followed the MDN articles and put together this TypeScript snippet [1]. Maybe somebody could comment on it?

Also sorry for the long link. Is there any accepted way to post a shorted URL?

Edit: added a corrected version [2]

[1]: https://www.typescriptlang.org/play?#code/DYUwLgBAbiDGYHsBOE...

[2]: https://www.typescriptlang.org/play?#code/FAiGGcE8DsGMAIBmBX...

Re: Password protect a static HTML page

#56

Post by benatkin »

Retr0id wrote: post #2

For anyone else wondering what the KDF is, it appears to be PBKDF2 with 1000 iterations: https://github.com/robinmoisson/staticrypt/blob/5dac008ba644...

Here's one w/ 100_000. Perhaps it's missing a couple zeroes.

https://github.com/yjs/y-webrtc/blob/master/src/crypto.js#L2...

Re: Password protect a static HTML page

#57

Post by lucideer »

paulpauper wrote: post #48
realPubkey wrote: post #15

Should have used the WebCrypto API instead of the crypto-js npm package. https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_...

What is the major difference? Isn't crypto-js still secure?

It might be. Whereas the native lib should be.

Just levels of trust. I'd happily use the former if the latter didn't exist.

Re: Password protect a static HTML page

#58

Post by pluc »

Xeoncross wrote: post #47

I'm not a cryptographer, but I'm pretty sure that CBC ( https://github.com/robinmoisson/staticrypt/blob/main/lib/cry... ) should be replaced with GCM ( https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypt... ) since this is not a stream. https://security.stackexchange.com/questions/184305/why-woul... (also, use the built-in WebCrypto API instead of the crypto-js package)

Leave it to full-stack devs to take care of cryptography

Re: Password protect a static HTML page

#59

Post by irrational »

paulpauper wrote: post #48
realPubkey wrote: post #15

Should have used the WebCrypto API instead of the crypto-js npm package. https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_...

What is the major difference? Isn't crypto-js still secure?

Why use a library (thus incurring the need for the user to download more JS) instead of using what is already in their browser?

Re: Password protect a static HTML page

#60

Post by scarface74 »

cubefox wrote: post #10
superkuh wrote: post #3

If you have to run javascript it is not a static page anymore. I've seen a lot of this particularly weird overloading of "static HTML" lately. Static HTML, or static webpage, is meant to describe the experience from the person who is trying to look at the page. It does not describe the experience of the dev. Using a dynamic script or application to generate a static html page that requires no JS execution is a static…

I would call any server side or client side code which alters the HTML non-static. A static HTML page is just an HTML file which is stored on the server and displayed as-is in the browser.

That’s not a generally accepted as the definition of a static page.

https://docs.aws.amazon.com/AmazonS3/latest/userguide/Websit...

> You can use Amazon S3 to host a static website. On a static website, individual webpages include static content. They might also contain client-side scripts.

By contrast, a dynamic website relies on server-side processing, including server-side scripts, such as PHP, JSP, or ASP.NET. Amazon S3 does not support server-side scripting, but AWS has other resources for hosting dynamic websites. To learn more about website hosting on AWS, see Web Hosting.

Post reply on HN