Question

Currently, our developers unobfuscate the javascript code so they can better QA our code in staging before we release to production.

However, sometimes, they forget to obfuscate the code before releasing to production.

I was wondering if there is a way to expire unobfuscated javascript so that, even if the QA developers forget to obfuscate the js it will auto obfuscate the js after a certain time frame (say 12 hours)?

Answer 1

Javascript does not obfuscate itself so this question doesn’t make a whole lot of sense.

Obfuscation is done by a separate tool in the build/release process. What you need is to improve/automate part of the release process to remove the chances of human error in that process. This can either be done with a more rigorous manual process or with more automatation.

In general, the QA team should be testing the EXACT same code that gets deployed on the final site so if that’s obfuscated, that’s what QA should test. So, first of all, I’d review what QA is doing and why. They should be testing the obfuscated code.

If QA needs to review the unobfuscated code for any reasons (I can’t think of any likely reasons myself), then they should make their own copy of the code on their own systems that is unobfuscated and should not be putting the unobfuscated code anywhere in the release process.

Lastly, it sounds like you would benefit from building an automated release process that does the obfuscation and deploys to both the QA test environment and the same process deploys to your production servers. That guarantees that obfuscation is in place and that QA is testing the exact same bits that would go to production when it’s released.