0

So let's assume we have two web sites:

  1. one is hosted on a public web hosting account with a public domain name e.g. mydomain.com

  2. the other is hosted on a local computer e.g. my laptop, but is configured to run with the same hostname e.g. mydomain.com, using Apache Virtual Hosts

So both will have the same window.documentURI or window.location.href.

Is there a way I can determine, using Javascript, which Web site is hosted publicly and which one is hosted privately?!

Thanks

EDIT

The reason I need this is I'm finishing up a JQuery Plugin that submits some data to a remote server [analytics basically] and I want to make the feature more secure by preventing spoofing by someone using a local server with the same hostname as the rightful user to mess up the data.

ObiHill
  • 11,448
  • 20
  • 86
  • 135
  • 2
    If your local DNS configuration is such that the local site hijacks the "real" hostname, then it'll be impossible to reach the real site. – Pointy Mar 21 '13 at 18:49
  • Maybe try the IP address? http://stackoverflow.com/questions/391979/get-client-ip-using-just-javascript – Hanlet Escaño Mar 21 '13 at 18:50
  • @HanletEscaño Thanks. It doesn't quite say how to get the IP address of the local web server, any ideas how I could get this?! – ObiHill Mar 21 '13 at 18:55
  • @HanletEscaño, it will give you the IP of the executing machine not the hosting machine. – gdoron Mar 21 '13 at 18:58
  • @HanletEscaño I'm not sure I get you. Will it give me `127.0.0.1` for the web site hosted on my local computer?! – ObiHill Mar 21 '13 at 19:03
  • @ChuckUgwuh, 1. it won't, *it will give you the IP of the executing machine not the hosting machine*. 2. You can test it, it is one line code... – gdoron Mar 21 '13 at 19:05
  • Ok, I just noticed something that could solve the problem, I'll be posting an answer on that shortly. – ObiHill Mar 21 '13 at 19:29
  • I saw your edit, javascript shouldn't be your last line of defense, and in this case I think it shouldn't be even your first line... – gdoron Mar 21 '13 at 19:32
  • @gdoron Yeah, I figure so, looking at some server-side options while I'm capturing the data. More on that shortly. – ObiHill Mar 21 '13 at 19:35

2 Answers2

2

Is there a way I can determine, using Javascript, which Web site is hosted publicly and which one is hosted privately?!

No. How exactly do you expect it to know? javascript has a very limited access control to the hosted machine.

gdoron
  • 147,333
  • 58
  • 291
  • 367
  • I was thinking maybe I could somehow retrieve the IP address from the server and if it's `127.0.0.1` then I'll know it's private. Trying to figure out how I'm going to do that though. – ObiHill Mar 21 '13 at 18:53
  • @ChuckUgwuh, I don't think you will get that address but the real IP address of the laptop, you can hardcode that value if you wish using a solution like [this](http://stackoverflow.com/a/810461/601179). By the way, why do you need it? – gdoron Mar 21 '13 at 18:54
  • I tried a couple of things on the server-side but can't seem to find a solution. I guess I'm going to have to advise clients to obfuscate their code to provide additional security. I'm keep looking though. – ObiHill Mar 22 '13 at 00:22
0

Not without the help of a third party service.

Your javaScript could send two AJAX queries: 1) to return the client's public IP 2) to return the public DNS IP of the domain. You would compare the two results.

Louis Ricci
  • 20,804
  • 5
  • 48
  • 62
  • Ok. Is there no way to get the loopback IP address, using javascript, from the local web server?! – ObiHill Mar 21 '13 at 19:01
  • @Chuck Ugwuh - On Windows and Internet Explorer you could use ActiveXObject loading inside of JavaScript (read: JScript) but in the general case, no – Louis Ricci Mar 21 '13 at 19:06
  • That's way too much hassle for what I'm looking to do. Thanks though. – ObiHill Mar 21 '13 at 19:24