Password protect html page

Question

I need to tack some simple password protection onto arbitrary html files. It does need need to be secure, but just keep out the random roff-raff. I tried using the below JS:

var password; 
 var thePassword="secretpassword"; 
 password=prompt('Enter Password',' '); 
 if (password==thePassword) { alert('Correct Password! Click OK to Enter!'); }
 else { window.location="http://www.google.com/"; } 

This works fine in Firefox, but seems that the prompt function fails in IE and so we always redirect to google...

Any suggestions on how to do a simple password protection using straight HTML pages?

EDIT: to be clear, it works fine in Firefox, and in IE does not even prompt with a popup asking to "Enter Password"

• jfriend00: The code seems to work fine for me on IE9. I just ran it in this jsfiddle and it works: jsfiddle.net/jfriend00/KkMRS. What version of IE are you running? I'd suggest putting an alert on what the actual value is coming back from the prompt.

Answer 1

Works fine for me in IE. Demo: http://jsfiddle.net/U2n3P/

One possible reason it may not be working is that you're populating the prompt with an empty space, by using ' ', so when you start typing there may be a space at the end. Change the prompt to:

password=prompt('Enter Password', ''); 

FYI, I know you said you didn't need this to be super secure, but you might as well add some security. Get an MD5 library and do, instead:

var thePassword = "md5encodedpassword";
password=prompt('Enter Password',' ');
if(md5(password) != thePassword){

• Alex Baranosky: the if statement I have is correct. I told you it works fine in Firefox. I'll look into the MD5 suggestion though!
• Alex Baranosky: because it ignores the statement that the code posted doesn't work in IE. IE ignores JS popups. I can't rightly use a popup like this for a password if IE will just ignore it.
• user578895: What do you mean IE ignores JS popups?!? prompt works perfectly well in IE.

Answer 2

Name the secure page or directory the md5 hashed password.

function isThere(url) {
 var req= new AJ(); // XMLHttpRequest object
 try {
 req.open("HEAD", url, false);
 req.send(null); 
 return req.status== 200 ? true : false;
 }
 catch (er) {
 return false;
 }
}
password=prompt('Enter Password',' '); 
password=md5(password);
if (isThere(md5 + "/") { window.location = password + "/"; }
else { alert("incorrect"); }

• Dog eat cat world: please comment why you vote it down, so far this is the only answer who allow you to protect the page without giving away the protected password or page.