How secure is SpreadsheetConverter for HTML, can anyone see my formulas?

Since the formulas are converted into JavaScript and the JavaScript formulas are in plain text on the web page, anyone who selects ‘View Source’ in the browser can see the resulting JavaScript. In a couple of hours, a person knowledgeable in JavaScript will be able to reverse-engineer the original spreadsheet.

Therefore, if you need to keep the formulas secret, SpreadsheetConverter for HTML is not for you.

The products SpreadsheetConverter for Java/JSP and SpreadsheetConverter for ASP&ASP.NET solves this problem, since the formulas will never leave the web server.

Microsoft has a solution that only works for Internet Explorer called Script Encoder. The solution is not totally secure, but makes reverse engineering much more difficult. It is a simple command-line tool that enables script designers to encode their final script so that Web hosts and Web clients cannot view or modify their source. More information about the Script Encoder can be found here:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/script56/html/SeconScriptEncoderOverview.asp

There are also other solutions out there, for example WebLockPro.com, which claims to encrypt the web page. Here you can read how to circumvent some of them:

http://www.vortex-webdesign.com/help/hidesource.htm

However, do not believe that your Excel spreadsheet is secure. There are a lot of hacks out there that removes the protection and passwords.

Does SpreadsheetConverter allow me to change cell formulas at runtime?

No, SpreadsheetConverter protects formulas from change.

How can I secure my SpreadsheetConverter calculator?

Place it on an HTTPS:-site and password protect it. How to password protect depends on which type of webserver you are using.

I do not want someone to have the ability to copy my program/code and post my intellectual property on another website.

Then you should use the ASP or JSP-solution. The formulas will never leave the web server.

Is it possible to have the web page password protected?

Password protection is handled by the web server.

For example if you use a Microsoft web server, you will create a separate directory for all password protected files. Then configure this directory to use passwords.

How do I protect certain cells so that entries cannot be made to them?

The user can only edit input cells. All other cells and formulas are automatically protected on the web page.

It is our intention to make the spreadsheet a chargeable product and therefore we want to protect the work by disabling the ability to save to a local machine.

Use the ASP or JSP-solution.

I want users to be able to modify only certain ranges within a sheet. I can do this in Excel under Tools / Protection / Allow users to edit ranges. Will your application support this type of protection?

The user will never be able to edit the formulas on the web page, so this protection is always there.

How make users login before using my calculator?

If you are using SpreadsheetConverter/ExcelEverywhere to HTML and want your users to login before they can use the calculator, the solution is to use the authentication of the web server to handle this. Both Internet Information Server (IIS) and Apache handles this.

If you use IIS, you can create normal Windows users and deny guest access to your web server.

If you use Apache, here is an article describing it: Protect Web sites with Apache Server’s HTTP authentication system. Alternatively, you can program the authentification yourself. Secure your Web pages with custom authentication Or, you can use ASP.NET’s form authentication. A simple solution is to store name + password in web.config. ASP.NET Form Authentication tutorial The SpreadsheetServer also handles logins.

Is the JavaScript encrypted?

No, we only have removed the new lines. If you want to make it easier to view the source, all you need to do is replace “;” by “;” followed by a new line.

I have IIS web server and ASP.NET has authentification. Can I use this to password protect the pages generated by SpreadsheetConverter to HTML/JavaScript?

Yes.

Change the extension from .htm to .aspx. Then, you should be able to use ASP.NET authentication system.