Secret Variable

[sanjay.bidi1]

I have puzzle in which I need to hash a value comprised of 2 form
fields and a shared password before submitting form to external web
application.

My question is, what are the possibilities for doing something like
this in JavaScript? In pseudo code terms I need to:

var myHash = someHashFunction("sharedSecret" + form.field1 +
form.field2)

but I do not wish to hardcode "sharedSecret" as it will be seen by the
browser. Certainly I can hide it a little in other js files, but this
is no real solution. I would like to do:

var myHash = someHashFunction(someVar + form.field1 + form.field2)

in which the client's browser never sees the value stored in someVar,
and where someVar is defined can never be accessed by a browser. I
wish this to be secret and protected.

In JSP perhaps I would read this from a protected properties file or
database, but this is JavaScript and not server-side scripting
language. Do you have any suggestion for me?

 

[Jeremy J Starcher]

I have puzzle in which I need to hash a value comprised of 2 form fields
and a shared password before submitting form to external web
application.

My question is, what are the possibilities for doing something like this
in JavaScript? In pseudo code terms I need to:

var myHash = someHashFunction("sharedSecret" + form.field1 +
form.field2)

but I do not wish to hardcode "sharedSecret" as it will be seen by the
browser. Certainly I can hide it a little in other js files, but this
is no real solution. I would like to do:

var myHash = someHashFunction(someVar + form.field1 + form.field2)

in which the client's browser never sees the value stored in someVar,
and where someVar is defined can never be accessed by a browser. I wish
this to be secret and protected.

In JSP perhaps I would read this from a protected properties file or
database, but this is JavaScript and not server-side scripting language.
Do you have any suggestion for me?

There is no way to keep something secret in Javascript, but I'm glad
you see that obfuscating isn't the answer.

Three solutions come to mind:

a) Have some AJAX-type thing compute your hash and return it.

b) Calculate the hash server-side after the form is submitted.
Since having a non-JS fallback is always best, that is the
approach I'd be tempted to take.

c) Look for a different hash method. Sans context, I'm not sure
what you are doing but at first guess it appears you are trying
to salt your hash.