ServerSide JavaScript

Question

I have a question about SSJS.

With SSJS, is it possible to hide code from the user?

Other ServerSide languages like PHP aren't viewable in the source because they are processed before the client side, the browser

A little example of what I want:

<html>
<head>
  <script runat="server">
    function getPassword(){
       var password = "myPass";
       return password;
    }
  </script>
</head>
<body>
  <script>
    alert(getPassword());
  </script>
</body>
</html>

I tested this, but the password is still viewable

Am I doing something wrong so that my example is simple CSJS or is it impossible to hide SSJS-code?

I don't think that adding `runat="server"` makes it server-side JavaScript. If you embed JS code into the HTML source code, then it is client-side automatically. — Šime Vidas, Nov 28 '10 at 12:50

score 0 · Answer 1 · answered Nov 28 '10 at 12:49

Yes, your server-side code can be hidden from the user, exactly as with any other server-side language. You have to serve the relevant HTML file via a server that understands server-side JavaScript, and you have to configure that server correctly (by default, .html files probably aren't going to be pre-processed; typically HTML files with server-side code would have a different extension, such as .shtml, .asp, .aspx, etc., depending on the platform on which you're running them; although of course with proper configuration you can have anything handled correctly). If you were able to see the code above via a web browser, then you've missed out one of those steps.

Note that server-side JavaScript will have the benefits, and disadvantages, of any other server-side language. You can't (for instance) do any scripting of the client's browser with any server-side language, which is why you see so much client-side code around. (Perhaps that was obvious. :-) )

score 0 · Answer 2 · answered Nov 28 '10 at 12:51

0

Any server side JavaScript will only be available on the server but, just as you need to run PHP through a PHP engine before sending it to the client, you have to run SSJS through a JS engine before sending it on.

You can find a list of such engines at Wikipedia, although node.js is probably the most popular at present.

runat="server" is, IIRC, an ASP.NET construct. If you want to go down that route, you'll need to be using ASP.NET for a start. I've no idea if the syntax you have is right though.

answered Nov 28 '10 at 12:51

Quentin

914,110
126
1,211
1,335

Thanks for the quick answer. A normal (shared,linux) hosting, does that support SSJS? In other words, can I assume that most sites can run SSJS? – Chielus Nov 28 '10 at 13:10
@Chielus No, node.js is very new and the platform (SSJS) is too young for most anyone to support it. – xj9 Nov 28 '10 at 13:35
Server side JS has been around since 1996, it just hasn't started to become popular until recently. – Quentin Nov 29 '10 at 15:56

KooiInc · Accepted Answer · 2010-11-28T13:24:17.147

Adhering to the wise words of T.J. Crowder, your file could be a classic .asp file on a windows based host (so a file with the extension .asp), looking like this:

<% @language=ecmascript %>
<% 
    function getPassword(){
       var password = "myPass";
       return password;
    }
%>
<html>
<head>
</head>
<body>
  <script>
    alert('<%=getPassword()%>');
  </script>
</body>
</html>

Or more in line with your style it could look like:

<script language="jscript" runat="server">
// mind the 'language' property, it is required. 
// The script tag doesn't have to be
// in the header of the html-document.
  function getPassword(){
     var password = "myPass";
     return password;
  }
</script>
<html>
<head>
</head>
<body>
  <script>
    alert('<%=getPassword()%>');
  </script>
</body>
</html>

Both ways the server side scripting will not be visible in the page source. Aside: <%=...%> can be viewed as shorthand for Response.Write(...)

For other hosts, check your provider or the wikipedia list given in David Dorwards answer

ServerSide JavaScript

3 Answers3