Forum Moderators: open

Message Too Old, No Replies

The impossible: protect HTML code, CSS, and images

You just can't do it!

         

DrDoc

8:28 pm on Jan 28, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Once upon a time, when I created my first few Web pages, I was a lot younger than I am now. I was naive, and thought that I could write some nifty JavaScript to stop the user from "stealing" my wonderful Web pages.

I soon realized four things:

1) It is impossible to protect source code, images - whatever it is that anyone can access - if they can access it, they can also steal it.

2) It seemed to me like only amateur sites even bothered messing with "protection". But no matter what they did, I could always find a way around it.

3) If I could find a way around it, then people who are a lot smarter than I am will also be able to grab the code, even if I try to stop them. Besides, why would they ever want to steal my code?

4) If anyone, against all odds, would want to take something I put on my site - be it images, code, CSS .. whatever - it's actually an honor. Apparently I did something they couldn't do, or they just liked it so much that they wanted to do the same thing.

Today, it still puzzles me to see all those questions pop up - "How do I protect my source code?" "How can I prevent someone from stealing my images?"

No offense, I understand how you feel .. Let me just tell you that it can't be done! However, there are always dumb users, those that will be fooled by those tricks ..

So let me tell you one little thing - if you're even going to attempt "protecting" your pages (even though you know you can't protect them 100%), then do it right!

If there's anything I hate, it is a pop-up stating that "No rightclicks allowed!" or "Copyright blah blah blah" .. or even worse, "Ha ha ha!"

All those things you can usually get around by clicking both mouse buttons simultaneously, and the context menu will pop up (try it in IE and you'll see).

So, I wasted my time putting together a nifty page. Here, take it .. do whatever you want with it.

At least this one isn't as annoying as most other scripts out there. And at least the context menu won't pop up no matter what they do (well, unless they have JavaScript turned off of course ;))

It supposedly works in IE4+ .. and in Netscape (prior to NN6). All other browsers - Opera, Mozilla .. - this script won't help. (Not that it helps anyway .. but, oh well.)

DrDoc

8:29 pm on Jan 28, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member


<html>
<body>
<script language="JavaScript">
<!--
stop=1;
function IE1(){
if(event.button==2){ }
}
// Mouse right-click stopped in Internet Explorer 4+
function IE2(){
if((event.keyCode==121 && event.shiftKey==true) ¦¦ event.keyCode==93){ }
}
// The use of Shift-F10 and the 'Context Menu' key stopped in Internet Explorer 4+
function IE3(){
event.cancelBubble=true;
event.returnValue=false;
}
// The famous mouse double-click getaround stopped in Internet Explorer 4+
function IE4(){
if(stop==1){
event.returnValue=false;
}
}
// Page content selection stopped in Internet Explorer 4+
function NN1(e){
if(e.which==3){return false;}
}
// Mouse right-clicks, Shift-F10, and the 'Context Menu' key stopped in Netscape 3+
function NN2(){
if(stop==1){
return false;
}
}
// Page content selection stopped in Netscape 3+

if(document.layers){
window.captureEvents(Event.MOUSEDOWN);
window.onmousedown=NN1;
window.onselectstart=NN2;
}
if(document.all){
document.onmousedown=IE1;
document.onkeydown=IE2;
document.oncontextmenu=IE3;
document.onselectstart=IE4;
}
//-->
</script>
<table width=450>
<tr>
<td>
<div align="justify">
<font size=5><b>No right-clicks or text copying!</b></font><br>
<br>
This script supposedly stops right-clicks and text selections in both Internet Explorer (version 4+) and Netscape (version <6). Try using the right mouse button, Shift-F10, and/or the Context Menu key. Also, try selecting any portion of this text. If the script works the way it is supposed to, you will only be able to select text in the form field below.</div>
</td>
</tr>
</table><br>
<form name="testform">
<input type="Text" value="You CAN select the text in this field" name="field" onfocus="stop=0;" onblur="stop=1;" size=50><br>
<input type="Text" value="You CAN NOT select the text in this field" name="field2" size=50><br>
<br>
<input type="Button" onclick="document.testform.field.select();" value="Select the text in the first field">
This button does not work<br>
<input type="Button" onclick="stop=0;document.testform.field.select();stop=1;" value="Select the text in the first field">
This button works<br>
</form>
</body>
</html>

EricL

9:57 pm on Jan 28, 2003 (gmt 0)

10+ Year Member



Has anyone ever been able to block "View"->"Source" on the IE browsers?

dingman

10:20 pm on Jan 28, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Even if they did, could you block:

wget --user-agent='Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)' [domain.com...]

DrDoc, Mods - can we stick this in the library and then just point people to it when they ask about copy protection?

EricL

10:35 pm on Jan 28, 2003 (gmt 0)

10+ Year Member



Yes, I've got web, MGET, wget (vers that basically all do gets, posts, puts with options) and it will obviously grab the entire stream.

I wonder who is really being stopped with JScript mods?

Who is really being "thwarted?"

[edited by: EricL at 10:38 pm (utc) on Jan. 28, 2003]

g1smd

10:36 pm on Jan 28, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



I don't see any point in protecting code.

However, if you want to protect images then apply a watermark to them.

victor

10:43 pm on Jan 28, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Protecting the surface view of a website is a minor goal compared to making sure all the vital business logic and so forth is not available to prowlers.

What you do serverside is gold dust. Don't let any of that leak. Especially, don't do clientside anything that is important.

piskie

11:54 pm on Jan 28, 2003 (gmt 0)

10+ Year Member



If I were to snoop on the code behind a page perhaps I would turn off JavaScript. I might even open files in my temp folder with a notepad or something..................The possibilities are endless.

There just seems no point in trying to protect code because when it doesn't work the code thief just smiles and thinks "Another Amateur".