Question

I understand that scripting language such as PHP will not be shown in the page source of the browsers. Is it not the same for JavaScript?

If so, why are they treated differently and are there solutions available to hide JavaScript from page source (revealed by browser)?

I don’t need the details about how exactly to hide it, just out of my curiosity if it has been worked on.

Thanks!

Answer 1

PHP is run on the server and produces some output, often HTML, but may also include XML, CSS, PHP, images etc.

JS gets sent to the client, and is run there, so they need to see it.

You can always view JS source, though you can obfuscate it. There isn’t much point though, as a decent debugger will let you work things out anyway.

For instance, using the Web Inspector in Webkit browsers, or Firebug will allow you to view the javascript and set breakpoints and see variable values, so it’s often trivial to work out what is going on.

This is OK though, and it one of the reasons why learning JS is so straight forward. When designed correctly, it’s rare that this presents a security problem.

You may find sites where the JS looks mangled and unreadable – this is frequently done to reduce the file size, hence all the .min.js files you see on websites rather than to make it hard to read.

Most people do this automatically as part of their build process, rather than doing it by hand. To do this, https://github.com/mishoo/UglifyJS is a good choice.