具有简单功能的页面的密码保护-缺点是什么？

Question

I am doing work on an e-commerce platform, and I was asked to come up with a solution so that a certain group of customers could enter a password protected page on the site. The platform doesn't allow for this, as in the functionality is not available, so according to customer support, it's something you would have to create a custom template for and build from scratch. It doesn't need to be fancy, or hacker proof, just secure enough . So instead of doing that, I dropped the script below into the body of the page.

My first version: I use a prompt to ask for an input (password). If you click "prevent this page from creating additional dialouges", it creates sort of an infinite reload loop for that tab (not ideal, but problem?). Are there other serious problems? Easy hacks for your average person?

$("body").hide();

var passwordCheckFunction = function() {

        var testPassword = window.prompt("YOU SHALL NOT PASS");

        if (testPassword === "thisPredefinedPassword") {
            $("body").show();
        } else {
            location.reload();
        }
    };
    passwordCheckFunction();

Any advice would be much appreciated, and thank you for your time.

Answer 1

1. Create your secret page as a category.
2. Customize it to your heart's desire by choosing a custom template file for it .
3. Finally, restrict it to only the authorized customer group by removing it from view from guests and every group except the authorized one.

Using this method, the customer only has to sign into his/her own customer account. BigCommerce will prevent access to the page by reading the assigned customer group of the customer.

Answer 2

I realize this isn't your desired method, but you might consider instead just making your page inactive in the admin area of your BC store, then instead of a password provide the direct url for users that are able to see that page.

I'm not sure about the implications for google indexing with an inactive page, but I would assume that they are set not to index it, and if not you could set it in robots.txt