Member Avatar for servis

Hellow,

Can we prevent exposing java script and css in source code of web page on the user machine???

please if anybody know about it????

shuja

  • 3 Contributors
  • 5 Replies
  • 235 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by jbennet

Dani AI

Generated

Short answer: as points out, client-side JavaScript and CSS cannot be hidden completely—browsers must receive the files to run them. The practical goal is not absolute secrecy but raising the effort required to read or reuse the code and, more importantly, keeping any sensitive logic or secrets on the server (as suggested).

Practical steps that actually help:

  • Move all secret logic and credentials to server-side endpoints; never embed API keys or proprietary algorithms in code sent to the browser.
  • Minify/obfuscate builds so casual readers see compressed, hard-to-read code (tools: terser, Closure Compiler, build-step minifiers). This raises the bar but does not prevent determined reverse engineering.
  • Avoid shipping source maps to production—source maps map minified code back to readable originals and will undo obfuscation if left accessible.
  • If assets must be restricted, serve them through an authenticated endpoint or use short-lived, signed CDN URLs; checking Referer is weak, session/auth checks are stronger.

Example patterns (illustrative):

<?php
session_start();
if (empty($_SESSION['user_id'])) { header('HTTP/1.1 403 Forbidden'); exit; }
header('Content-Type: application/javascript; charset=UTF-8');
readfile(__DIR__.'/assets/app.min.js');
# produce a mangled/minified build
npx terser src/app.js -c -m -o dist/app.min.js

Troubleshooting notes: verify production builds do not publish .map files, and inspect the browser DevTools Network tab or curl to confirm what files are publicly reachable. Remember: obfuscation delays analysis; true protection comes from keeping critical logic server-side. This complements ’s organizational suggestion (external files) while clarifying that externalizing files alone does not prevent viewing.

Recommended Answers

All 5 Replies

Member Avatar for jbennet

No.

Obviously, the browser needs to be able to see the code in order to render it.

Member Avatar for sikka_varun

Hi...
You cant hide the code in the browser if you have written it in the html/php/js/.. source file..

So in order to hide your css and javascript code, better to create its files..
for eg.. for javascript... create a file with .js extension
say:
and write all your javascript code in it.. (without <script></script> tags ofcourse)...
And in your html page call this file..

<script type="text/javascript" language="JavaScript" src="myscript.js">

The browser will only see the above line and not your js code..

For the CSS files.. create a file with extension .css : eg: style.css

And include your styles in this file..
And in the head tag, use the following code:

<head>
<link rel="stylesheet" type="text/css" href="style.css">
</head>

Hope this helps you..

Member Avatar for jbennet

yeah but people can still steal them

just put in the path

e.g

commented: Spot on ;) +13
Member Avatar for servis

sikka_varun thank you for your valueable solution...this is very much working.
jbennet, I think you may prevent these files path to steal by using php or some server side coding, if any body try to open the url, it send him the message "You are not allowed to view this file"...

Member Avatar for jbennet

There is no way to 100% protect it. Its simple. They have to see the code in order to run it, because it is a script.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.