Whats the risk in sending source code of web files to the browser?
For many types of files, there’s no risk. .HTM files, for instance, are designed to be sent in their entirety to the browser. However, .ASP and other advanced file types are intended to never leave the server – only the output of the file, when processed by the scripting engine, should be sent to the browser. The reason is that web content developers sometimes include sensitive information in .ASP and other advanced file types. For instance, they sometimes include information such as passwords in the files in order to personalize the content that they generate. This is contrary to recommended practices, and secure methods of storing and using such information are available; nevertheless, it is a frequent error. If such a web file were sent directly to a browser, it could compromise any sensitive information it contained.
