*Discussion* Client side page permissions - Javascript / jquery / cookies / other?

Question

TLDR Using plain HTML / Javascript. Want to block access to some pages (doesn't have to be super secure just to stop some peeking eyes).

I would like this to be a discussion preferably on different ways of doing this? If anyone has any other ideas than using cookies or differeny ways to do this.

---

I thought of simply doing this by setting a cookie for each page they are allowed to visit with a value of true but thats a bit messy. Although it would work. Is there a way to set an array of values to a cookie so I can read the cookie and if a name of a page is in there then allow access with an IF statement or so on each of my pages. If they dont have the cookie just to replace my #content (entirepage) to "sorry no" etc.

For example:

 $.cookie("Access","page1, page2, page3",{ expires: 1 });

Am already using JQuery, Jquery cookie. etc.

I am up for anyway of doing this cookie idea is just an example I am working on a cookie version at the moment just thought it would make an interesting question and to see what people thought would be good at client side? Because I mean if it wasn't for the case I had I would never use client side :P

---

Note: I have some ASP pages that require login etc. But this is a seperate directory on the server. So nevermind about all of that. They will have to type a username / password at some point upon doing so I can assign a cookie or such. (Don't want serverside) just to reiterate. It really doesn't matter if they can break it. Its just to stop prying eyes and sneaking fingers. If they take the effort to break it which I have no idea why they would in this case the information they have access to does nothing in this case..

---

Answers not containining USE SERVERSIDE LOL would be appreciated it is not part of the question or what I asked for. I know serverside makes alot more sense but I do not want to use it here. There really is no need to.

So what do you think would be the best / most efficient way of managing this?

Answer 1

If you have server-side access, I'd highly recommend this. Anyone can kill their cookies at any time.

There's really no way of reliably denying access on the client-side as far as I know (almost anything can be spoofed or modified or removed), but we'll see what other people come up with.

Otherwise, I'd just recommend removing read privileges for the affected files or with your access rules (many different ways to do this among many different servers, <File> or <Directory> in Apache), or creating a simple HTTP authentication file (in Apache, a .htpasswd file and some rules in the .htaccess file or <VirtualHost>).

Answer 2

If the pages are known and limited, how about generating all the contents on the fly, with AJAX for retrieval?