Forum Moderators: open
I have read quite a bit about hiding HTML source code and lots of people say that this is a bit of a red herring. Gold at the end of the rainbow kind of thing - it is not possible. But how about hiding the code of a javascript.js file. Is this possbile? One method that seems pretty good to me can be found at
[devpapers.com...]
I would like you guys to look at this and see what weaknesses may be associated with it. Is there anyway someone could get around it to see my javascript code? Thanks guys.
In case the moderator pulls the url - I have cut and paste the webpage here:
Don't want your JavaScript copied? Here's a very simple script that will hide it!
On the page where the JavaScript is placed, add:
<?
session_start();
if(!session_is_registered('allow_script'))
{
session_register('allow_script');
$allow_script = true;
}
?>
<html>
<head>
<script language="JavaScript" src="script.php"></script>
</head>
<body>
Body goes here...
</body>
</html>
And now create a new file called script.php and place your JavaScript there:
<?
session_start();
if($allow_script)
{
header("Content-type: text/javascript");
?>
alert("Woohoo! My JavaScript Works!");
<?
$allow_script = false;
}
?>
As you can see it uses a session. When you open the page where the JavaScript is placed it creates a session which allows the JavaScript to be viewed. But if you open script.php by its self, no session is created!
Try opening script.php in your browser window and you'll notice you can't view the code!
Can u elaborate please mate. Don't quite understand.
"Obviously, there is some way around it, because the browser has to read it."
I understand that there must be some way around. But would be good if peeps could take through ways to get around it. Such that I could even act to take further steps to block off these ways around.
I understand this is not a final solution - more one of slowing down curious visitors (and hoping they give up) than stopping.
What I really hope for this is that the people on here must be pretty good on computers - and if no one here can figure a way to get around this to see the javascript source code - then i am onto a winner - because the average visitor really won;t have a clue how to do it then.
I know that it must theoretically be possible to get around - but how many people would know how to get around. That is the Q.
HTH,
-George
Is there any way around this? I am not very hopeful - but perhaps worth asking.
Or are Temp Internet files the be all and end all - this is the end of the line.
By the way - thanks for all these posts.
joke:
You could state on your website that they clear their temp folder after each visit to your site - but something tells me this wouldn't work ;-)
To be honest rhodopsin I am quite sure there is nothing much you can do except accept it.
[added:[/b] You could scramble your code which makes it a little harder to read and recreate - but again there are tools out there that can make your scrambled code readable again :( just search for JavaScript Scrambler
-George
The PHP session one is a new one for me.
I added the "?" because I'm assuming that the script file (.php notwithstanding) is cached - but I haven't actually tried the approach myself.
This could probably be worked around by instructing the server to send a "no cache" header. (this might be ignored).
Suffice to say that there is no 100% way of protecting anything, but there are ways of making it a little tricky. The question is then "who are you hiding it from?". If your script is so whoopee-doo that it needs to be "protected". Then anyone who was put off by the limited defenses available would probably be lacking in the skills needed to make use of the script anyway.
Practicalities aside, it's an interesting contribution.
Currently looking at setting up no cache headers.
Another thing that i am doing to test how good this method is of hiding code - look at this url. Quite interesting. Seeing how it holds up to these tests:
[vortex-webdesign.com...]
Can anyone think of a way to beat this method of hiding? I am going to use
<?php
header("Cache-Control: no-store, no-cache");
?>
to beat the temporary internet file factor - this code stops the browser from caching the php page.
If you can view the source code of the html you can locate the url that supplies the javascript.
If you can locate the url, just type it into a browser - the browser will display it or prompt you to save it as a file.
Messing around disabling right-clicks, etc. is just a waste of time - just switch off javascript or go to the browser's view menu.
If someone wants your code they'll get it - end of story.
Kaled.
Can anyone think of a way to beat this method of hiding?
Sorry, I haven't got round to testing, rhodopsin. I suspect that saving the file as .mht ("web archive for email") in IE may include the script file as one of its parts.
[webmasterworld.com...]
It starts off being related to hiding PHP - but soon moves to hiding javascript. Scroll down the thread and you will see what i mean.
About the hex business - that seems very interesting. Would be really greatful if you could point me to more info on this.
If you would like to hide your javascript source code there could be a way. I guess u can use an HTML or source code encryptor software.
This would also encrypt the html content. Or else you can call the code from a .js file and then encrypt only the .js file.
I hoped this help you.
[siteexperts.com...]
the guy set a challange to crack his code. It took 8 days for someone to do it. Pretty good going. Of course - it was ultimately cracked. Uncrackable is not possible - but it is nice to make them work hard for it.
Haven't checked this out yet. Will write more when looked at it.
Some of the hiding mechanisms in the challenge are just dead ends for people who think they've made it when they, for instance, unscramble the encoded script to find they've been tricked into wasting their time.
