2

I'm writing a JavaScript that generates some data. I intend to use it as a free web application, open for everyone that want to use it.

But I got a lot of time and effort to write this this script (mainly because I want it to personal use and I couldn't find anything efficient and resumed as this). I'm a beginner developer and I know is impossible to protect or obfuscate the script because you don't even need other app to decoding obfuscated info, there's a lot of methods and the laziest is just find the "eval" word in the js file and replace it with "alert". When you open the html page boom you receive a popup window with all the code decoded...

What I'm asking is if there's anyway to prevent when a user "save as..." the page with the browser, the JavaScript and CSS files do not be saved in the structure. In the past I tried to save some pages with the browser and I only could save the html file (and sometimes not even with all the html information, I suspect there was iframes), no js and no css... I tried with some websites downloaders (sitesucker,deepvacumm,etc) and not even with this downloaders I was able to download the files. The only way was to "inspect" the page and download it manually and make the folder structure manually.

As I said I want to give this script totally free as a service (I will even buy a domain for it) because I made it with love. My only request (to receive some kind of personal pride) is that when people want to use it they came to my site and made it in real time and if they "save as..." the page, they can save the generated information that don't save the script, so they came back again to use the service.

Does anyone can help with some tips and information. Links, advice, professional and personal tricks?

3
  • I don't know how those downloaders work, but if you load all JS/CSS through JavaScript, then the files are not visible inside the HTML, so downloaders may not download it.
    – pimvdb
    Aug 27, 2011 at 11:20
  • Hello pimvdb! Can you give me some links or information? hows that? Because if I "save as..." a page I always save the scripts linked in the head. If you could send me some material to inform me it would be great! Can You give an example page? Thanks!
    – Joana
    Aug 27, 2011 at 11:27
  • What kind of data are you generating? Aug 27, 2011 at 11:56

4 Answers 4

2

I think it is not possible to prevent access to the Javascript code in the browser. I also think that by minifying the JS code e.g. with Google's Closure compiler (ADVANCED option) you protect your code as much as you can. Although the code can be copied as it is, it cannot be understood or modified with a reasonable effort.

7
  • Obfuscation and Encoder: Hunt down all occurences of "document.write" and "eval" inside the Javascript and replace them with "alert". Open it with a web browser, which will make the decoded JavaScript appear inside one (or several) pop-up "alert" windows completely decoded.
    – Joana
    Aug 27, 2011 at 13:08
  • @Joana You're mistaken the difference between packer and obfuscator. What you describe are packer which are used to minify the size of the script, while obfuscator do not care about the size of the output and only care about modifying the code structure to make it harder to read and understand. An example of what an obfuscator could output is this : codegolf.stackexchange.com/questions/88/…
    – HoLyVieR
    Aug 27, 2011 at 13:32
  • @Joana: did you try your "attack" at a site compiled with Google's Closure? Try e.g. this one or www.google.com.
    – Jiri Kriz
    Aug 27, 2011 at 13:37
  • @Joana Google Closure works a lot differently than other minifier, it does modify your code. It renames variables and function that are in a well defined scope. If you are using constant, they will often be inlined in your code. Those optimization are there to reduce the code size and it also as a side effect obfuscate your code.
    – HoLyVieR
    Aug 27, 2011 at 13:42
  • Yes, I did it! Right now in the www.nosco.ch! Like I said the obfuscation is impossible, it's only difficult for some people. I don't want to hide it mainly from coders and developers, I only want the avarage user to downloaded it with the "Save as..." option, THAT'S IT! I want they use it in my website... Do you know any html compiler???
    – Joana
    Aug 27, 2011 at 13:54
0

You could download all JavaScript/CSS files through one JavaScript file (a loader), like this. That way, downloaders have to execute JavaScript before they can know what JavaScript/CSS files are included, which I don't think they do. As I said in my comments, I'm not entirely sure whether this works!

HTML:

...
<script src="loader.js"></script>
<!-- no other JavaScript/CSS here -->
...

loader.js:

window.onload = function() {
    var head = document.getElementsByTagName('head')[0]; // the <head>

    var scriptElement = document.createElement('script'); // create <script>
    scriptElement.src = 'file1.js';
    head.appendChild(scriptElement); // add <script> to <head>

    var linkElement = document.createElement('link'); // create <link>
    linkElement.setAttribute('rel', 'stylesheet');
    linkElement.href = 'file1.css';
    head.appendChild(linkElement); // add <link> to <head>
}
4
  • It's pretty easy to see the script tag that is added in a decent dom inspector like firebug or the chrome dom inspector, the OP is better of putting a restrictive license on his javascript source, minify it and hope no one abuses the license
    – Charles Ma
    Aug 27, 2011 at 11:38
  • @Charles One wouldn't have to search for SCRIPT elements at all. It's enough to open the "Network" tab in Chrome's dev tools, and monitor which HTTP requests are made. Aug 27, 2011 at 11:55
  • In the end, if the user can download the files, a downloader also can. It was just an idea.
    – pimvdb
    Aug 27, 2011 at 11:58
  • Thanks pimvdb! It's a start to use with some other resources. Like I said my motivation right now is only to prevent the "regular" and "normal" user to download it with the "Save as..." browser option, making it difficult enough so they came to my site and use it!
    – Joana
    Aug 27, 2011 at 13:01
0

Convert your code to a server side script (PHP, Python, C#, etc). It's the only way to be sure your users won't be able to "steal" your work.

JavaScript must eventually be decoded by my browser, and at that moment, is available to me too, and there is no way to prevent it, you can only make it harder.

But the bottom line is: why do you have to do it? If you only want "personal pride" wouldn't it be better to upload your code to a collaborative site like github or SourceForge where other people can appreciate your work and maybe even contribute to it?

Also, if you share your code under a licence like GPL or CC everyone who reuses your code must give credit to you (yes, one can simply steal it, but that is possible under your scenario, too).

2
  • My personal pride is only to feel that some people is using my service (because I intend to make a hole network is a few months. So, I want to feel it and not to have a lot of "copies" of my script in a lot of websites. That doesn't make it "special"...), also it would be better for statistics to have one source and everyone could use in one place. I didn't think of that but I wil check github! Thanks for the reply and sugestion, kiss joana
    – Joana
    Aug 27, 2011 at 12:50
  • I heard about PHP but is not my area... I will try to check it! Which of those examples (PHP, Python, C#, etc) do you think is better for compatibility vs performance vs accessibility (from my part as a beginner)?
    – Joana
    Aug 27, 2011 at 13:20
0

There is really no technical solution to your problem: if the user can execute your javascript, they will have to download it somehow. Whatever solution chosen, anyone with sufficient knowledge of Firebug or the Webkit inspector will be able to retrieve the script. You can obfuscate it my minifying it, but it will not prevent anyone to use it as-is.

The solution to your problem is legal, not technical. If you explicitly state, in your Javascript header, that the script is under a restrictive licence, anybody copying it would break the law. If you find somebody doing this, you can then:

  • nicely ask them to remove the script from their site
  • threaten to sue?

(by the way, if I may give a personal opinion here, there is much personal pride to be had in giving away code anybody can re-use... you can include your name and a link to your site in the header of the script: it is considered very bad form (and potentially illegal) to remove attribution and copyright notices)

1
  • Yes, you're right. My main motivation right now is only to prevent the "regular" and "normal" user to download it. I just want they came to my site and use it. I will not even obfuscate it. There's no sense in that, at least for me because the advanced user can decode the obfuscation with ONE word and the Text Edit or Textpad...
    – Joana
    Aug 27, 2011 at 12:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.