Question

I want to be able to give strict access to specific users to my web page, not BY IP; but through Javascript and HTML.

How easy will it be to get the security string?

function fc4me(srvstr) {

   if(!document.pleazfc4me.email.value || !document.pleazfc4me.securitystring.value) {
      alert("Please fill in all the required fields!");
      return false;
   }
   if(document.pleazfc4me.securitystring.value != hexMD5("\x73\x73"+srvstr)) {
      alert("Registration Authorization String not accepted! Try Harder! ");
      return false;
    } else {
      document.pleazfc4me.submit();
    }

}

and the other page?

Security String<font color="orange">*</font>:
<input type="text" name="securitystring" size="35">
<input onClick="var srvstr='foo';fc4me(srvstr);document.pleazfc4me.securitystring.value='';return false;" name="submit" type="image" src="images/button-submit.png" />

Answer 1

It doesn’t matter. document.pleazfc4me.submit(); in the console and you bypass your checks altogether.

I could just as easily turn off JS altogether and the form would submit as default behavior.

You can use as much obfuscation as you want but unless you do some check in the server side code to reject an unauthorized user, anyone can bypass this.