Member Avatar for hansan

Hello,

  • I want to protect my external javascript(and css also) from outside people, who steal my javascript.
  • but this is impossible using client-side language.
  • so can anyone tell me a method to hide external javascript(and css) by using sever-side language???

thank you

  • 3 Contributors
  • 6 Replies
  • 248 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by pres-pnoy

Dani AI

Generated

Short answer: you cannot totally hide JavaScript or CSS that the browser must receive. Anything delivered to the client can be inspected and copied. The practical strategy is to move any sensitive logic to server-side code, and—for deterrence—combine server-side access control with obfuscation/minification and short-lived/signed delivery. That gives protection against casual copying while keeping critical secrets on the server.

A common server-side pattern is to serve files through a PHP endpoint that validates a signed token (HMAC) and an expiry time. Example flow and minimal PHP sketch:

// token generation (on the page that renders the <script> tag)
$secret = 'replace_with_secure_secret_stored_outside_webroot';
$file = 'myscript.js';
$exp  = time() + 300; // expires in 5 minutes
$token = hash_hmac('sha256', "$file:$exp", $secret);
echo "<script src=\"/protected_js.php?file={$file}&exp={$exp}&token={$token}\"></script>";

// protected_js.php (verification + delivery)
$secret = 'same_secret_as_above';
$file = $_GET['file'] ?? '';
$exp  = intval($_GET['exp'] ?? 0);
$token = $_GET['token'] ?? '';
if ($exp < time() || !preg_match('/^[a-zA-Z0-9_\-]+\.js$/', $file)) { http_response_code(403); exit; }
$expected = hash_hmac('sha256', "$file:$exp", $secret);
if (!hash_equals($expected, $token)) { http_response_code(403); exit; }
$path = __DIR__ . '/protected_js/' . $file;
if (!is_file($path)) { http_response_code(404); exit; }
header('Content-Type: application/javascript; charset=UTF-8');
header('Cache-Control: private, max-age=300');
readfile($path);

Notes and cautions: tokens and signed URLs deter hotlinking but are visible to any client while valid, so they are not a foolproof secret. Do not rely on HTTP_REFERER. Remove source maps from production, minify/obfuscate code to raise the bar for casual copiers, and move any business-critical logic to server APIs. For high-scale setups use signed URLs from a CDN or short-lived pre-signed object URLs. In short: was right that obfuscation helps; ’s pointers may show examples; but the only true protection is to avoid shipping secrets to the browser in the first place.

Recommended Answers

All 6 Replies

Member Avatar for EverWebby

Encrypt it

Member Avatar for hansan

but how? do you know?
please can you tell me a place to find any code ?

Member Avatar for hansan

but anyone can decode it. isn't there any method to hide the code from user (i.e. by using sever-side language or what ever.)

Member Avatar for EverWebby

obstrucation..

Member Avatar for pres-pnoy

go to this blog. the answer is there

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.