如何混淆或使我的 JavaScript 文件不可读？

How can i obfuscate or make unreadable my JavaScript files?

提问by Bhargav

I have JavaScript scripts in my application containing JavaScript and jQuery functions. All user interaction with my application is dynamic and it's passing to the application through jQuery.

我的应用程序中有 JavaScript 脚本，其中包含 JavaScript 和 jQuery 函数。所有用户与我的应用程序的交互都是动态的，它通过 jQuery 传递给应用程序。

What I realized is, when I run my application, on the client side, the client can see my all source code by viewing page source (Ctrl + U).

我意识到，当我运行我的应用程序时，在客户端，客户端可以通过查看页面源代码 ( Ctrl + U)来查看我的所有源代码。

How can I hide or do something so that user can't understand or read the source?

我怎样才能隐藏或做一些让用户无法理解或阅读源代码的事情？

I want to do something like what Facebook does. By viewing Facebook source user can't reuse its source code or even understand it.

我想做一些类似于 Facebook 所做的事情。通过查看 Facebook 源代码，用户无法重用其源代码，甚至无法理解它。

I googled and found that this process is called obfuscation, but this doesn't work for me.

我用谷歌搜索，发现这个过程叫做混淆，但这对我不起作用。

I tried this:

我试过这个：

http://www.javascriptobfuscator.com/default.aspx

http://www.javascriptobfuscator.com/default.aspx

and

和

http://dean.edwards.name/packer/

http://dean.edwards.name/packer/

and

和

http://www.daftlogic.com/projects-online-javascript-obfuscator.htm

http://www.daftlogic.com/projects-online-javascript-obfuscator.htm

even i tried http://www.jasob.com/

即使我试过 http://www.jasob.com/

But it's of no use for me.

但这对我没有用。

回答by ThiefMaster

If someone really cares about your code he will take the workload of un-minifying (replacing random with useful variable/function names). Anything else such as "encrypting" or packing is just snake oilsince it can be reverted extremely easy. So save yourself some work and rather spend it on making your application better.

如果有人真的关心您的代码，他将承担取消缩小的工作量（用有用的变量/函数名称替换随机数）。其他任何诸如“加密”或打包之类的东西都只是万金油，因为它可以非常容易地还原。因此，为自己节省一些工作，而将其花在使您的应用程序更好上。

So: The only thing you should do on a production system is minifying your JS code. This makes it smaller and thus faster to load - so it is an actually advantage. Besides that, it will make it less readable to people who are just curious for a quick look but don't want to spend time on it.

所以：在生产系统上你唯一应该做的就是缩小你的 JS 代码。这使得它更小，因此加载速度更快 - 所以它实际上是一个优势。除此之外，对于那些只是想快速浏览但又不想花时间的人来说，它的可读性会降低。

The facebook JS files for example are just minified by the way - most likely just for bandwidth/performance reasons.

例如，facebook JS 文件只是顺便缩小了 - 很可能只是出于带宽/性能原因。

---

---

The easiest way to minify your JavaScript is using Google's web service for it: http://closure-compiler.appspot.com/home
Note that it has an 1MB limit so if your JS is that huge, you might need to download the Java-based minifier to run it locally.

缩小 JavaScript 的最简单方法是使用 Google 的 Web 服务：http: //closure-compiler.appspot.com/home
请注意，它有 1MB 的限制，因此如果您的 JS 很大，您可能需要下载 Java -based minifier 在本地运行。

回答by RSG

Everything ThiefMaster says is true. It's also worth noting that your apps should be designed with the assumption users can see and manipulate everything on the client. If you're worried about obfuscation because you think it will prevent users from seeing sensitive data or manipulating information such as prices, then you need to redesign your application so that secure logic resides on the server.

ThiefMaster 说的都是真的。还值得注意的是，您的应用程序的设计应该假设用户可以看到和操作客户端上的所有内容。如果您担心混淆，因为您认为它会阻止用户查看敏感数据或操纵价格等信息，那么您需要重新设计您的应用程序，以便安全逻辑驻留在服务器上。

回答by user1587368

As I need to minify my javascript source code, I'm looking for a javascript program whose minify itself any javascript code.

因为我需要缩小我的 javascript 源代码，所以我正在寻找一个 javascript 程序，它可以缩小自己的任何 javascript 代码。

Why a javascript minifier ? Because, i'm writing some randomized javascript code from the web server to the client.

为什么是 javascript 压缩器？因为，我正在编写一些从 Web 服务器到客户端的随机 javascript 代码。

I should use "node.js" on the web server to execute a javascript program which generates a javascript code and minifying it on the fly and send it to the client.

我应该在 Web 服务器上使用“node.js”来执行一个 javascript 程序，该程序生成一个 javascript 代码并动态缩小它并将其发送到客户端。

This javascript program is a : encryption and decryption program. The javascript code result for the client should contains a javascript function which decrypt each portion of a json or hexadecimal version of an encrypted data. The function executes some plus, minus and multiplications of integers. Sometimes, I can generate a condition (if,then and else) to compute two different operations. This function is used to decrypt two or more parameters inputs.

这个javascript程序是一个：加密和解密程序。客户端的 javascript 代码结果应包含一个 javascript 函数，用于解密加密数据的 json 或十六进制版本的每个部分。该函数执行一些整数的加、减和乘法。有时，我可以生成一个条件（if、then 和 else）来计算两个不同的操作。此函数用于解密两个或多个参数输入。

That's the randomized function : each time the client requests some private data, the web server generates two different javascript functions : one for encryption and one another for decryption. The decryption function is sent to the client. The encryption function is used by the web server to encrypt and send private data to the client. It's make a sense for obfuscation : each time the process is running, each time the sending function is totally different.

这就是随机函数：每次客户端请求一些私人数据时，Web 服务器都会生成两个不同的 javascript 函数：一个用于加密，另一个用于解密。解密函数被发送到客户端。Web 服务器使用加密功能对私有数据进行加密并将其发送给客户端。混淆是有意义的：每次进程运行时，每次发送功能都完全不同。

And, to convince the encryption/decryption is very secured, I add for the client, a tabular values conversion of two or more parameters ; but, the tabular values are generated, in fact, by a function written for the web server only and contains some numeric constants, which are NEVER send to the client. Thus, any one whose want to decrypt must have the constants value.

而且，为了说服加密/解密非常安全，我为客户端添加了两个或多个参数的表格值转换；但是，表格值实际上是由仅为 Web 服务器编写的函数生成的，并且包含一些永远不会发送到客户端的数字常量。因此，任何想要解密的人都必须拥有常量值。

I'm explained that process because :

我解释了这个过程，因为：

1. you are taken some things about obfuscation in javascript source code; but, obfuscation in javascript is not yet implemented by web server and browsers...maybe, it could happen...but, what kind of solutions is useful with the help of "SSL-ize" all transmission over the internet.

2. It's possible to crypt and decrypt with encryption/decryption functions which can be readable. And, without the cost of SSL certificates. Even, "a man in the middle" would decrypt the encrypted data ; for that, he just has to execute the javascript function. Ok..but imagine that the javascript decryption function is also encypted...then, the "man in the middle" has to execute the decryption function and then decrypt again the decrypted content which are javascript function to decrypt the encrypted data.

1. 你在 javascript 源代码中做了一些关于混淆的事情；但是，Web 服务器和浏览器还没有实现 javascript 中的混淆......也许，它可能会发生......但是，在“SSL-ize”通过互联网进行所有传输的帮助下，什么样的解决方案是有用的。

2. 可以使用可读的加密/解密函数进行加密和解密。而且，没有 SSL 证书的费用。甚至，“中间人”会解密加密数据；为此，他只需要执行 javascript 函数。好的..但是想象一下javascript解密函数也被加密了……然后，“中间人”必须执行解密函数，然后再次解密解密的内容，这是javascript函数来解密加密数据。

And, imagine if the web server asks a question to the client and the unique answer is handled by the client's result computation (whose not sent through Internet) ... it's impossible to "the man in the middle" to have the answer.

并且，想象一下，如果 Web 服务器向客户端提出问题，并且唯一的答案由客户端的结果计算处理（其不是通过 Internet 发送的）......“中间人”不可能得到答案。

Check out my idea; i'm waiting for comments from any one.

看看我的想法；我在等待任何人的评论。