0

Situation/Enviorment:

I have a project written which's core is an NodeJs Web- and API-Server. I'd like to sell it to multiple clients, they will host the server on their system.

Problem:

The NodeJs-Server runs with source-code, and is thus very vulnerable to being shared, manipulated or copied.

Goal:

Protect the source-code from any external influences, in a way of compiling, enclosing or securly encoding the source-code to enable it to be shared to multiple clients wihout the risk of it being manipulated or copied.

I've learned about a approach to this problem, the very promising enclose.js, but I'd possibly like to evaluate multiple methods to secure NodeJS source-code, suggested by security experts, and eventually find a good/best practice to deal with this.

Improve this question
5
  • stackoverflow.com/questions/9413123/…
    – Bacon Brad
    Commented Aug 11, 2016 at 18:15
  • @baconface, simply distributing it as a binary doesn't prevent theft IMHO.
    – Abhinav Das
    Commented Aug 11, 2016 at 18:18
  • @0x23212f I was pointing out this is a duplicate. But in the case of a V8 snapshot you could not retrieve usable JavaScript from the binary. Which might be good enough for the original poster. It does not protect it from disassembly though and V8 snapshots do suffer a performance hit. But that is a standard way of protecting Node.js projects.
    – Bacon Brad
    Commented Aug 11, 2016 at 18:47
  • If it's a packaged product, unauthorised redistribution is probably more damaging than someone reading your code. And there are other ways to make code difficult to read, but none of them foolproof. But yes, I see what you mean.
    – Abhinav Das
    Commented Aug 11, 2016 at 18:52
  • you can't hide source code that needs to run, forget about it and explore legal options instead of non-existent technical ones.
    – dandavis
    Commented Aug 11, 2016 at 20:10

2 Answers 2

Reset to default
1

Look, from a business standpoint, I think that if you could package it as a hosted-service, that would be a good way to avoid your code being used by unauthorised people.

There is no way to guarantee that your application isn't distributed even if you obfuscate it heavily etc to protect your I.P.

I strongly suggest selling the product with the SaaS or PaaS model where your clients use your website (a frontend) to interact with the service/product.

Improve this answer
0

I agree with @0x23212f's answer. Obfuscating or pre-compiling JavaScript has limited potential. If it were C you might have better success, but high-level languages, including Java, can readily be de-compiled or de-obfuscated.

With this in mind, you will have to control the server-space in which it is stored. One nice benefit to doing it this way, is that your stack traces will be intact.

I assume since you have not yet solved this problem, than it must be a new product. New products tend to have errors even in production so full stack-traces will be useful.

If you must pre-compile, you take a few steps such as

  • Using Google Closure Compiler (which will likely give you a mapping to the original for stack trace purposes) This is a reliable way to obfuscate variable names, but the structure of the program remains intact.
  • Distributing the file as an encrypted Base64 string with some sort of decryption method. (easily circumvented)
  • Some type of self-inspection to alert you if the files are changed (requires internet access)
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .