Can I encrypt content so it doesn't appear in view-source, then show on pageload?

I've got a site where users extend their product trial with a registration code. They click a开发者_开发知识库 link (with a key in the URL) from an email, get to this site and a lightbox appears with their registration code. I'm currently displaying the registration code with HTML and hiding it with CSS. Once I check to make sure the URL has the correct key with javascript, I display the registration code. However, this means anyone can just view source on the page and copy the registration code. Is there a way to encrypt the code so it doesn't appear in view source, and then decrypt it if the URL has the correct key? It's one code per product, not per user, so I don't have to do any server side authentication.

---

If the computer knows it, the user knows it.

You can play obfuscation games, all of which amount to making your Javascript hard to read. But a sufficiently determined user will find it anyway, and once they do, they can easily share it with their friends.

One code per user is the only way to fix this reliably.

---

I check to make sure the URL has the correct key with javascript

Don't check the key client-side, validate the key on the server.
This is the only way to ensure only valid users get the registration code.

Pseudo PHP example:

if( validateKey($_GET['key']) ) {
    echo 'The Registration Code';
} else {
    echo 'Error';
}

---

Client Side Code is inherently insecure. Consider anything you send to a client machine public to the world, and don't trust anything that comes from the client until you cleanse it. A sufficiently determined user will de-obfuscate your code, regardless how much effort you put into the initial obfuscation routine.

---

Another tip to help you instead to show the registration code in the site you can send back an email to the user with the registration code.

And as Nemo suggest, the right way is one code for user

Hope it help

---

As mentioned before the client side will not cover your security needs.

Better would be to have the page send a Ajax request to the server containing the key, you can then respond with the registration code.

Even better would be to directly validate the key on the first request, then decide to return an error page or the page with the registration info.

---

As others have replied, doing this validation server-side is both easier and more secure.

You can have an AJAX request posting the URL key to a php page, that in turn would reply with the correct registration code.

That being said, there is always the possibility of using a client-side use encryption library (like AES), but from what i understand i don't think it would be a good approach to solving your problem.

Again, doing it on the server-side is both extremely easy and as secure as you need.

---

Encrypt your registration code (plus some magic cookie) with the key in the server before embedding it in your HTML. In your JavaScript, validate the key (which comes in the URL) by decrypting the registration code. If the magic cookie matches, then you get a valid key and you can display the registration code to the user.

View Source will only reveal the encrypted registration code. Without the key, the snooper has no way to extract the registration code.

This means that you'll have a unique key per registration code, which should be the case for your registration system. The key you send to the user in an email, embedded into a link which they click as you said.