3

We are developing an application sending highly sensitive data over the Internet. For this we use client side encryption so that even if an attacker would get access to our servers, the data could not be decrypted. Now our clients want the application to be web based. That is a problem because now an attacker could modify the JavaScript code on the server, making all kinds of attacks possible.

Can we protect the code somehow? Is it possible to sign the JavaScript code using a private key and configure the Browser to test the signature?

Improve this question
2
  • This is really unclear. How can an attacker modify scripts on your server? Do you have really dreadful security on your server that allows anyone to modify files on it? You have no control over what the browser does - if you send anything to it, there is no way to ensure that an unmodified version is being run at the other end.
    – Matthew
    Commented Dec 15, 2015 at 8:42
  • @Matthew An attacker can modify the scripts on the server by hacking it. Of course we do all against that, but one can always get hacked.
    – Nathan
    Commented Dec 15, 2015 at 9:51

2 Answers 2

Reset to default
5

Use https. This will encrypt and sign all your content between your server and the users web browser.

This does not protect from modification on your server, of course, but when your server is compromised then everything is lost anyway. Web application security simply doesn't work if the server gets compromised.

If you want to sign your code, then Browser-based Javascript isn't the right technology, because there is no code signing and verification system in web browsers. It would be hard to introduce one, because then all scripts on the whole WWW would suddenly need to be signed or the users would get bombarded with missing signature warnings, which will lead to them getting used to just ignore them.

An alternative option would be to use a good old Java applet, because they support code signing.

Improve this answer
0
0

I attended a debate (video) where they introduced CodeSealer, which they claimed protect JavaScript code among other components. Please visit the links in this answer for more information, it sounds like what you're after.

Disclaimer: I am in no way affiliated with CodeSealer or the IT University of Copenhagen. I have also not tested CodeSealer.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .