0

I am new to MVC platform and developing one business application in which I am using some JavaScript Excel Library. From Controller action, I pass my MODEL to view and then in View, I fill up my custom Excel Library by setting up business formulas & values from Model.

As my JavaScript code is purely dependent on MODEL (i.e. Server data) so I guess, I don't have choice except to write JavaScript code in my view (cshtml) file. As in separate JS file, my model will not available. But this approach have severe security risk that any one can easily find-out my business formula in JavaScript after viewing View Source of the page.

I notice there is "Bundling & Minifying" option in MVC5 but I could not find that how can I include this dynamic JavaScript code in it (as a String???). So please need an EXPERT opinion that with which best approach I can secure (as much as possible) my Javascript code? I know it can't be completely secure but atleast make it harder to understand as much as possible.

Thanks,

3
  • You can always pass your model properties to functions in an 'external' file, but that wont address your 'security' concerns since anyone view the page can view any script file used by the page. The only way to keep your 'formula secure' is to use ajax to send the parameters to a controller, perform the calculations on the server and return the result.
    – user3559349
    Jan 18, 2015 at 12:02
  • Even when code is minified, it's not really possible to keep it a secret for anyone who wants to know what it does. Javascript will always be readable by the client, because it needs to be executed by the client. Wouldn't it be more secure to use a JSON api and keep all the sensitive info on the server? Then all you do in the javascript is a request to the server to do the calculations, and the user won't be able to see your sensitive information. Jan 18, 2015 at 12:43
  • Yes, you are right that even after Minified, JavaScript will be readable. But definitely it will be harder. Actually I cannot use Ajax call because we have to create 4 Grids on Client and if any value change in Grid, then we need to recalculate all Grids and then display, same like we do in Excel. So requirement is to have experience same like Excel, if I use AJAX then it will not acceptable to rebind Grids from Server on each single value change. So want to keep my data on client side with all formulas. I know that it will not purely secure but just want to make it as much harder as possible Jan 18, 2015 at 13:12

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.