Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have developed an web app with jquery,html-css markup which would be an premium web app. So I have to ensure the security of the code from being stolen.But as all these are client side,so there is no 100% secure way to protect them.But I want to make them harder to steal.For this I did :

  1. I have disabled the right click button of mouse
  2. I have minified and obfuscated the code.
  3. I have used js code to add external js file and obfuscated the code so that none can understand the name of the external js file
  4. I have created a index.html file in the js folder so that none can get access the js folder

Do you think all these are enough to make stealing harder? Or any suggestion/advice for me?

share|improve this question
2  
Consider: The people most likely to steal your code are other developers ... if you can defeat your security measures, they're not doing anything to protect your code. –  danlefree Aug 8 '12 at 1:22
    
JavaScript is client side and stored in cache. So along with viewing the source of your site finding the file path names of the page which rendered and using chrome developer tool to view all the Scripts. It's pretty easy to get the code unminify it and then then un obfuscate the code. The time you're spending to protect your code could be spent on further developing your application. JavaScript can't be protected 100% –  Anagio Aug 8 '12 at 11:31
    
If you disable right click, the will use left click and go to FILE and then SAVE AS, saving whole of your project –  Fahad Uddin Mar 4 '13 at 7:49
add comment

4 Answers 4

up vote 7 down vote accepted

It's impossible to prevent your Javascript from being "stolen" because the code is served to the browser. To answer your specific points:

1. I have disabled the right click button of mouse

This will have absolutely no effect. No one will ever try to steal code using right click (heck, right click doesn't give access to anything in a browser anyway). So it won't prevent "casual thieves", let alone people who actually know what they're doing.

2. I have minified and obfuscated the code.

This is a decent step as it makes it much harder to understand exactly what the code it doing. However, there are are plenty of code "deminifiers" out there that will reformat the code nicely - albeit with unintelligible variable names.

3. I have used js code to add external js file and obfuscated the code so that none can understand the name of the external js file

If you load an external file at any time it is captured by browsers' developer tools (check the Network tab in Google Chrome). So this won't add any extra protection.

4. I have created a index.html file in the js folder so that none can get access the js folder

Again, this is worthless as anyone can see what JS file is loaded. Furthermore, "index.html" is a terrible way to prevent folder listing, it should be accomplished server-side (e.g. .htaccess file).


The real answer: you can't prevent Javascript theft at all. Minify and obfuscate to prevent any easy understanding of your code, but that's all you can do in terms of JS.

You may be able to move some of the logic to the server-side (and use AJAX in your app), which would of course prevent any users from using the JS without modification - they would need to replicate your server-side logic themselves.

And finally, don't forget that the Javascript code you write is already your property and copyrighted by you. If someone steals it they are breaking the law and you can seek legal action against them.

share|improve this answer
    
+1 The only way to protect JavaScript code is not to post it online at all. Make it available only when someone has paid for it. If you need to demonstrate to potential buyers how a commercial script works, do this with screenshots, explanations, and video walkthroughs. Alternatively, produce a free "light" version of the script with a greatly reduced featureset, then explain what benefits the paid (unpublished) upgrade will offer if they purchase that. –  Nick Sep 22 '12 at 9:55
add comment

I have disabled the right click button of mouse

Don't do this.
There are valid uses for right-click that you are blocking in addition to (not) protecting your code. All you'll do is annoy everybody while doing absolutely nothing to stop the people who know enough to try and steal your code in the first place.

share|improve this answer
2  
+1 for not being annoying. kilianvalkhof.com/2011/javascript/… –  Anthony Hatzopoulos Aug 7 '12 at 23:29
    
Indeed. In modern browsers I just press F12 (on Windows, something else on others) to bring up the developer tools and I have access to a hell of a lot more than right-click can get me. –  Olly Hodgson Aug 8 '12 at 11:15
add comment

Use PHP to make the JavaScript only load if the user is authenticated (by premium subscription?)

I have created a index.html file in the js folder so that none can get access the js folder

What if they guess the file name? You should be using a .htaccess for this to do a Options -Indexes to disable directory viewing; it's foolproof.

But most web applications I know of/write use some sort of hypertext processor like PHP or ASP. The source to the actual functionality is entirely closed if it runs on a secure server. Who cares if someone steals the CSS/JavaScript if when they copy the "source" they get a non-functional copy? You could also get it copyrighted or patented if it's unique and innovative.

share|improve this answer
    
A blank index.html file isn't such a bad idea. .htaccess files can become corrupt, which renders any Options -Indexes directives worthless. –  Nick Sep 22 '12 at 9:38
add comment

I have solved my problem by injecting php in it.I have wrote an article on it - Ensure Security of JavaScript Code from being stolen.I have solved it by jQuery ajax, json and php. Here are some code snippet:

           /*
             code.js
           */
           var temp;
           function calculate(){
             var a = $('#a').val();
             var b = $('#b').val();
           /*
            var c = 10;
            temp = (a + b)/c;
            $("#target").html(temp);
          */
        //Do above calculation on the server side
        var dataString = 'a=' + a + '&b=' + b + '&c=' + c;
           $.ajax(function(){
                type : "POST",
                url  : "calculate.php",
                data : dataString,
                cache: false,
                dataType: 'json',
                success: function(data){
                temp = data.temp;
                $("#target").html(temp);
               }
              });
           }

And php script :

if($_POST){
$a = $_POST['a'];
$b = $_POST['b'];
$c = $_POST['c'];
$temp = ($a + $b)/$c;
$data = array('temp' => $temp);
header('Content-type: application/json');
echo json_encode($data);
}
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.