Show HN: Password-protect a static HTML page
In highschool I realized that my school's grading system was using a javascript scheme to control access to grades online:<p>1. Concatenate the username and password, hash the combination<p>2. Name the HTML file with the grades using that hash<p>3. When the user logs in, calculate the hash in Javascript and redirect to that HTML page.<p>In theory, you can only work out the URL of the page if you have the username and password in hand. I'm sure it was pretty trivially bruteforcable, but aside from that it seemed sort of okay.<p>Until I realized that directory listings were turned on, and the directory that had all the HTML files sometimes had no index.html, thereby rendering the entire obfuscation scheme moot.<p>(n.b. I was too ethical to use this to peek at anyone's grades! I did try to report it but it was never clear to whom to report it to, and since every teacher generated these files using their own copy of the program, there was no obvious central place to report this to. A couple of years later online grades were centralized into a different system)