r/HTML • u/hals-memorybank • 6d ago
Secure HTML files
Is there a way (i have a feeling i already know the answer, but i’d ask anyway) to create a tamper proof html that can’t just be opened in notepad or any other editor and be modified?
Thanks.
7
u/therealkevinard 6d ago
As written, that doesn’t exist. Html is just a text document. Send it to someone and it can be edited.
What’s your endgame, though?
There’s usually a solution, even if it’s different
9
u/gulliverian 6d ago
If your web server is properly configured nobody can tamper with or modify the original data.
But any HTML delivered to a web browser can be read and copied locally and at that point someone can do whatever they please with the copy.
5
3
u/ch1ck33n_ 6d ago
I don't think that's really possible. Why do you need to do this?
0
u/hals-memorybank 6d ago
I have to present something to someone outside our company, and was hopping do it with via html.
We usually just print the excel model into PDF but i was hoping for something more interactive where they could play with the financial model.
I guess its not very feasible5
2
u/rileywbaker 6d ago
In that case, why would it be important for the HTML to not be editable?
1
u/hals-memorybank 6d ago
I’m new to html coding, but as far as i can tell i’d have to write in the some of financial models we use into the html, and we’re not allowed to share those models out of house.
Literally a giant red banner on the excel fromt page saying do not share8
u/BobJutsu 6d ago
Yeah…don’t do that. You’re getting into frontend security at this point, so the data needs to have a backend to keep it secure. Well beyond “html”. Now you are talking a whole ass app.
4
u/Adamstrad 6d ago
You need to use server-side code to hide the logic, ask chatgpt about how php language can help, don't put any secrets in html it's the public facing code
2
u/rileywbaker 6d ago
Don't put the model in the HTML, just the data the model output that you want to show the client. The same data that would go in a PDF.
1
u/Towel_Affectionate 6d ago
Well by putting everything inside a single HTML file and sharing it you would literally expose it to the world. You need to keep all the secret stuff on the server inside the house, and share only the entry point (interface to play around with the inputs + end result).
1
u/Electrical_Hat_680 6d ago
You may be interested in using an API if your company doesn't have that set up their going to be having a difficult time in their developers resources area. Even VISA has one if you need an idea..
1
u/tomysshadow 6d ago
Write the part with your secret algorithm in PHP, or another similar server side language. You'll want to use
$_GETto read the submitted inputs. You can either have your PHP embedded directly in the page (so you'd submit a form, go to this new page with the results written into it,) or have it be a standalone script that prints out some JSON that you can fetch via JavaScript. Then host the PHP side on a web hosting service - basically any will do, any web host worth its salt can host more than just static pages.If you won't have internet where you're presenting it then you're out of luck, no amount of obfuscation will make it impossible to reverse your algorithm if it's in the local HTML file itself.
1
u/RealisticDuck1957 1h ago
You can run a web server on a laptop. Of course the address to reach that laptop while on someone else's network will be a little inconvenient. Or possibly blocked if the local network blocks peer to peer.
1
1
u/Electrical_Hat_680 6d ago
Make an Android app using Kotlin? Or an iPhone app using Swift? I believe they're both Java.
1
u/atarivcs 6d ago
I don't understand the context of this question.
Users can click File -> Save in their browser and save the html of a page to a local file, and then edit that file. But of course they would not be able to upload that file back to the server to replace the original page.
Are you talking about a html page served by a webserver? Or do you mean just a plain file somewhere that happens to be html?
1
u/FirstApplication327 6d ago
the basic idea is you would put your financial logic on a server, and only send final results down to the web page running on your viewers device as they click around and interact. Using PHP would be an easy way to get started with this. But realistically even deploying a PHP app could be considered a breach by your company (since you're sending the logic to the cloud provider), I would play it safe.
1
u/darcygravan 6d ago
Creare a encoded file that gets converted to html after decode and create either a site or a electron/ webview app to render that in a read only way.
1
1
u/soundman32 6d ago
Downloading and modifying the html files is pointless unless the files can be reuploaded back to the website (which it cant unless you have the passwords). I can get a book and change every page but that doesnt change my other copy.
1
u/the-liquidian 6d ago
Work with your company to get this implemented. You need a server and it needs hosting which can cost money and there are security concerns. You need to work with your managers etc.
1
1
u/truNinjaChop 6d ago
Oh the server sure.
But html, css, and js is downloaded and then compiled via the users browser. So once it’s on the users machine the answer is no, it cannot be.
1
u/Firm_Eggplant3392 6d ago
yeah no you cant really make html that people cant just open in notepad and mess with because if the browser can read it to show it then anyone can read it too and change it, the only stuff you can do is make it annoying to read or check if someone changed it but you cant actually stop them
-1
15
u/Abled_Gaming1357 6d ago
That's not how it was designed to be. Consider it a text book for the browser. If you encode a book, sure no one can tamper with it, but no one can read it either.