View Page Source
By Felipe Lodi
We have seen before how HTML though useful is limited. We have seen also that HTML is what the Browsers interpret in the end, on the client-side, on the user side. Scripts in the other hand are very important to either change dynamically the HTML on the client-side or create dynamically HTML code on the server-side sending these results to the client-side.
Scripts can work on HTML created by scripts as long as this coding is well formed. Actually one layer does not have to be aware of another, the Web developer however takes all this into account when planning, designing and developing, so he can provide the best results on each layer, either on the server-side or client-side.
The Web developer also knows that client-side code can be easily seen by everyone. All HTML code rendered by the Browser is accessible on the Browser itself. There are some way to do this either using built-in capabilities of the Browser (e.g. View Page Source on Google Chrome) or copying and pasting the content into a Web developing tool (e.g. Microsoft SharePoint Designer). There is an option also on main Browsers to save the current page. This option on the Internet Explorer for instance, saves the current page as a HTML file as well as the accessory files such as scripts, images and style sheets in a separated subfolder.
Client-side code, for example JavaScript code, can also be seen using all of these methods. It is important to mention that JavaScript code can be put along the HTML files or on “.js” files, this is an implementation choice, but on both cases the client-side code is exposed. On the later though, the advanced user has to figure out the reference tag to the external script file and then navigate to the files using as base the root URL. Therefore there is no way to protect client-side code, HTML and scripts.
On the server-side things are different though. All scripting hardly developed to generate the HTML to be shown on the client-side is protected. Starting from the fact that the server-side scripting does not have to obey the same URL structure the end user sees on his Browser. Server-side scripts usually are also in different number than the resulted HTML as Web developers can use the benefits of Frameworks, Assemblies and Object Models.
Using CGI (Common Gateway Interface) is another way that pages can be generated by an executable file. “A CGI executable is a standard executable file but such that the HTTP server can tell it in fact contains a program that is to be run” states Herme. (Herme, 1997) By executable, we can understand this code has been compiled and therefore, even if the advanced user gets this executable, the proprietary source code cannot be seen, so it is not possible to understand how pages are created from this file.
Besides dynamically created HTML code, server-side code usually has database connectivity details, business rules data and even more information about the Company that owns the code. Therefore it is highly recommended keeping all this source code safe and protected against threats.
Therefore, even if the advanced user gets the resulted HTML pages and client-side scripts, they cannot do much with that. They will not be able to know how these pages were created as he does not have access to the source code, the server-side code. For the sake of clarity, some examples of languages that work on the server-side are PHP, Java and Asp.Net.
REFERENCES LIST
Herme, 1997. Writing basic cgi-bin applications. [Online] Available at: http://clip.dia.fi.upm.es/miscdocs/pillow/pillow_www6/node2.html [Accessed 27 March 2011].













