Password protected hyper link with target=_blank

Question

I have a hyper link like this :

<A Href=My_Java_Servlet?User_Action=Admin_Download_Records&User_Id=Admin onClick=\"Check_Password();\" target=_blank>Download Records</A>

When a user clicks on it, a password window will open, the user can try 3 times for the right password.

The Javascript looks like this :

<Script Language="JavaScript">
  function Check_Password()
  {
    var testV=1;
    var pass1=prompt('Password','');
    while (testV<3)
    {
      if (!pass1) history.go(-1);
      if (pass1=="password") { return true; }
      testV+=1;
      var pass1=prompt('Access Denied - Password Incorrect.','');
    }
    return "false";
  }
</Script>

If user enters the wrong password 3 times, it's supposed to not do anything, but it still opens a new window and displays the protected info, how to fix the javascript or my html hyper link so only the right password will open a new target window, a wrong password will make it do nothing ?

Answer 1

Why are you returning "false" instead of false ?

Answer 2

You might to try returning false rather than "false"

However, you might be better off doing this kind of thing on the server, as I'd image all but novice users will know how to "copy link address" and paste this into their address bar.

Answer 3

Clientside JavaScript is perhaps the worst possible way to provide "security". Users can just view the source to see all of your passwords, or just disable JavaScript altogether. Do not do this.

Answer 4

Other people have answered your question with the true/false return value but here's some of the problems with the whole idea of checking the password in javascript on the client:

1. Your javascript source is freely readable by anyone downloading the page - thus showing them the password needed to view the page.

2. If they don't have javascript enabled then they'll just go straight to the page without getting the javascript prompt.

3. They could always just copy the link and paste it into their address bar to bypass the password protection. They could also just middle-click the link (which should open it in a new tab/window depending on their browser.)

Even on a private/intranet-only application this would be a laughable security method. :) Please consider re-desinging it so that the password is checked on the server-side portion (like when someone attempts to access the servlet it would render a password box and then post that password back to the server and then allow/deny access.)

Answer 5

Yes, great advice, I'll check it on the server side, thanks folks !!!

Frank