Method to 'compile' javascript to hide the source during page execution?

Question

I wanted to hide some business logic and make the variables inaccessible. Maybe I am missing something but if somebody can read the javascript they can also add their own and read my variables. Is there a way to hide this stuff?

Answer 1

You could encrypt it so no one can read it.

For example

http://daven.se/usefulstuff/javascript-obfuscator.html

Answer 2

That's one of the downsides of using a scripting language - if you don't distribute the source, nobody can run your scripts!

You can run your JS through an obfuscator first, but if anyone really wants to figure out exactly what your code is doing, it won't be that much work to reverse-engineer, especially since the effects of the code are directly observable in the first place.

Answer 3

You must always validate the data you send back. I've had a rather entertaining time playing pranks on a forum I'm a mod of by manipulating the pages with the Web Developer Toolbar. Whether or not you obfuscate it, always assume that data coming to the server has been intentionally manipulated. Only after you prove it hasn't (or verify the user has permission to act) do you handle the request.

Answer 4

Javascript cannot be compiled, that is, it is still Javascript.

But, there's this: http://dean.edwards.name/packer/

Generally, this is used to reduce the code footprint of the Javascript, if say your script is being downloaded thousands of times per minute. There are other methods to accomplish this, but as for hiding the code this sort of works.

Granted, the code can be unpacked. This will keep out a novice but anyone who is determined to read your source code will find a way.

It is even this way with compiled languages, even when they have been obfuscated. It's impossible to hide your code 100% of the time -- if it executes on your machine, it can be read by a determined hacker.

Answer 5

Any code which executes on a client machine is available to the client. Some forms of code are harder to access, but if someone really wants to know what's going on, there's no way you have to stop them.

If you don't want someone to find out what code is being run, do it on a server. Period.