0

My website is in /var/www/html.

I have a few files (PHP and Javascript) that are one level up, in /var/www.

I'm able to access the PHP file for my MySQL login credentials, but I can't access the Javascript file. In the <head> of my Login document, this is how I have it:

<script src="../sha256.js"></script>

This worked fine until I moved the sha256.js file. But now, when I try to login, the document can't find the file.

Improve this question

1 Answer 1

Reset to default
4

Can I access a Javacsript file that is out of the document root?

No.

If it isn't under the Document Root then it doesn't have a URL1.

If it doesn't have a URL then the browser can't request it.

Given the URL http://example.com/ and the relative URL from it ../foo the browser will delete a 'directory' off the end of the URL for each ../. If there aren't any, then it will ignore them. Thus it resolves to http://example.com/foo.

I'm able to access the PHP file for my MySQL login credentials

This is, presumably, server side code which deals with the server's file system and not with URLs.

1This is a simplification. There are other ways (alias, mod_rewrite, etc) to give a file a URL, but for your purposes, moving the file under the Document Root is the simplest solution.

Improve this answer
Sign up to request clarification or add additional context in comments.

8 Comments

Unless their is a RewriteRule or a PHP front controller that can look at the REQUEST_URI to decide whether to load a resource from outside the document root or not.
Lol, well I think you just covered that. +1
@Landslyde you can't hide it. If your page needs the browser to fetch the code, then it has to be in an accessible URL.
@Landslyde — You can't … but you shouldn't need to. Hashes are one-way and sha256 is a standard anyway. That said, you shouldn't need to hash the password on the client anyway. Hash it on the server … but use SSL to encrypt it when you send it to the server.
@Landslyde The point is that you shouldn't use (client-side) Javascript to hash the password. Since you're using PHP you should use password_hash to hash it server-side before storing it and then password_verify when you need to check if an entered password is correct. password_hash will handle doing things the right way (using a slow/iterating algorithm like bcrypt, instead of a fast hash like sha256, which is not meant for passwords, and automatically adding a random salt).
|

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.