Hacker News Reader

Comment by dmvaldman | Hacker News Reader

The most interesting bit is the part about the Link header. Does anyone know if this would be a way of concealing your frontend javascript files?

View on HN

This is not possible; scripts cannot be added through `<link>`, so there’s no way to add them through the `Link` HTTP header.

Would the functionality be possible if browsers wanted to make the functionality possible? I feel like this would be a big deal when it comes to the IP concerns of frontend code.

Your browser would still download the files. You can still the downloads using Live HTTP Headers, Firebug, Fiddler etc. to see what is going on in the background. So it would be like disabling right-click - deter only the least knowledgeable.

In Opera, it is possible in a way:

    Link: <javascript:alert(1)>; rel="next"

This won’t do anything until you hit the “next” button in the Opera UI (or hit the Space bar, which is a keyboard shortcut for said button).

Example: http://xss-shafigullin-pro.appspot.com/reflector

Reply on news.ycombinator.com