How can I "cloak" my Javascript and CSS files using PHP?

Question

Would it be possible to display different content if someone opened one of my .js or .css files in a browser? I configured Apache to execute PHP code in .js and .css files. How can I detect if the file was requested by a webpage or viewed directly by an user?

Edit: I know there's no way to hide my files 100%. I'm looking for the best way to discourage people from copying my code.

This is yet another case of "You can't give information to someone without giving them the information" — Ben
– Ben, Commented Jan 1, 2012 at 5:24

jfriend00 · Accepted Answer · 2012-01-01 05:27:39Z

7

Nothing on the web that works in a browser can be genuinely cloaked. The browser is just an agent requesting the file, same as any agent requesting the file for any use. A server knows no difference between a browser downloading a JS file as part of a web page and a user downloading the JS file to view it. To the server, they are just requests to download the file. The server doesn't know what's going to be done with it.

Even further, JS files and CSS files are usually kept in the disk cache (for performance reasons) where they can be retrieved independent of the server.

The only thing you can do is to obscure your code with minification and obfuscation. Minification makes sense because it also makes thing more efficient. I wouldn't personally recommend obfuscation because it doesn't really stop a determined viewer - it only slows them down slightly. If the browser can understand the JS file to run it, then so can a hacker.

In general, people seem to think that their javascript is somehow way more important a secret than it really is. If you do have some sort of secret algorithm that really needs to be protected, then your best bet is to keep the code for that on the server and use ajax calls to access it from your client javascript as needed.

edited Jan 1, 2012 at 5:27

answered Jan 1, 2012 at 5:21

jfriend00

711k104 gold badges1.1k silver badges1k bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Brigand Over a year ago

I think your last paragraph really sums it up. If you don't want people to see it, don't send it to them. Keep your secrets on the server.

nnnnnn Over a year ago

+1. Further to your last paragraph I think some people have an over-inflated sense of how good their own code is, too, like there are thousands of people out there lining up to copy it. (I don't mean to imply the OP is such a person; I think this is a question all web developers ask at some point.)

sergiogarciadev · Accepted Answer · 2012-01-01 05:28:57Z

0

You can detect if the file is called directly by the user checking the HTTP Referrer header. But it will not prevent the user to check in Firebug or equivalent tools to see the source of your script.

answered Jan 1, 2012 at 5:28

sergiogarciadev

2,2211 gold badge24 silver badges37 bronze badges

1 Comment

jfriend00 Over a year ago

Or just set the referrer header as desired - something any determined hacker can do (though it's easier to get it from the disk cache) or capture it in a network traffic analyzer. There is no way to allow a browser access and not allow a human access.

Collectives™ on Stack Overflow

How can I "cloak" my Javascript and CSS files using PHP?

2 Answers 2

2 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related