Home/ Questions/Q 539431
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-13T10:08:07+00:00

I’m working on what aims to be a secure method of user registration and

  • 0

I’m working on what aims to be a secure method of user registration and authentication using php and javascript but not ssl/tls.

I realise this may well be considered an impossible task that’s been tried 1000 times before but I’m going to give it a go anyway. Every example I see online that claims to do it seems to have some huge fatal flaw!

Anyway, my current problem is verifying javascript at the client. The problem being that if my sha1 implementation in javascript is modified by some man-in-the-middle it’s not secure at all. If I could just verify that the received javascript has not been tampered with then I think I can pull this off.

The real problem though, is that the only way to do things on the client side is javascript. Simple: write a javascript to verify the integrity of the other javascript files. Nope! Man-in-the-middle can just modify this file too.

Is there a way around this?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    To secure your JavaScript, you must examine it in an guaranteed untampered environment. Since you can’t create such an environment in the browser this is not possible. Your best option is to download the JavaScript via HTTPS. That isn’t safe but better. Possible attack vectors left:

    • A virus can modify the browser to load some malicious JavaScript for every page
    • A keylogger can monitor what the user is typing
    • A proxy can act as a man-in-the-middle for an HTTPS connection. The proxy will actually decode what you send via HTTPS and encode it again (with a different certificate) for the browser.
    • A proxy can add iframes to the pages you send
    • 0