views:

113

answers:

4

How can I make a javascript file only work on a single domain. I'll compress this file and when somebody tries to use it by copying my web site or just the javascript file, it won't work and give alert.

Here is an example. I downloaded all files but when try to view it gives an alert that says I need to buy it (what exactly I'm going to do :)

+4  A: 

You can't really do this. You could put something at the beginning of your code like this:

if (window.location.href.substring(0, 18) != "http://example.com") {
    alert("You thief! Stop using my code!");
}

...but all that means is that the person using it would remove that from their copy. Obfuscation might help, but not necessarily by much. Anything the Javascript interpreter can interpret, someone can copy and reuse. All you can do is set the bar a bit higher, and you probably have more important things to do.

T.J. Crowder
Use `location.host` in preference to hacking at `href`, and best do a `toLowerCase()` on it to get a case-insensitive comparison.
bobince
@bobince: Good points both. But of course, there's little point anyway...
T.J. Crowder
+5  A: 

That's not possible, javascript can be obfuscated but an adept developer can always figure that out and use your files. You can copyright your file but still in countries where there is no privacy policies, this won't matter.

Sarfraz
I couldn't obfuscate this js file..
HasanGursoy
@HasanGursoy: Even if you could, it would not matter in front of an adept developer to decipher that.
Sarfraz
+1 this is a legal problem not a software problem.
Rook
@The Rock: My problem is not to de-obfuscate this file actually. My problem is to make one like it. And see if it **can be** de-obfuscated.
HasanGursoy
@HasanGursoy There is absolutely no doubt in my mind that this this file can be de-obfuscated. I would try using a debugger or worst case would be to hook eval() and print out its value each time. Sometimes a recursive eval()'s are used. I have de-obfuscated php based malware in the past, and its not difficult.
Rook
+2  A: 

In scripting languages the source code and the program are the same as opposed to compiled languages in which you compile the source code into a binary which is in a different format. That's why (as others said) you can't protect your JavaScript code from being used by others. The only method (other than the obfuscation that others mentioned) is to move the implementation elsewhere, you can create a web-service containing the logic you want to protect and then have your JavaScript call this using AJAX (and verify that it comes from your site).

This has the obvious disadvantages of being slower and making you supply processing power instead of utilizing the client side processors.

Motti
You can decompile a compiled language, Ida pro is powerful.
Rook
@Rook Sure you can decompile some languages, I was arguing the other direction, since the source code is what gets executed there's not concept of protecting the source code while distributing the executable code.
Motti
+1  A: 

Run it through JSMIN (uglifier), if you are still worried, javascript is the wrong solution.

Anders