Question

I’ve developed a system that polls a server and injects the response JavaScript into the clients web page. I want to obfuscate the JavaScript the server serves, but I also want to know if there is a tool that dynamically obfuscates it according to a token or key. Meaning every new session gets unique scripts that will only work with that client during that session.

If this doesn’t already exist, could someone maybe provide me with a link on how to write my own JavaScript obfuscation tool.

Answer 1

Chris, I encourage you to look at this a different way.

First of all, your problem seems to be that you want to display something on your web page, but you want to disguise the methodology that it got there. The absolute best way to do this is to execute all of your code on the server.

This frees you up so that you don’t have to obfuscate anything. Any Javascript that you execute would just be working on raw data anyway, and wouldn’t be anything specialized that a hacker could do anything with.

A hacker could not see your business processes if all of the work was done on the server.

So, you can make an Ajax call out to the server, which executes the code, and returns HTML or JSON data that your app can then use to place on the webpage. The hacker has nothing to go on, and you don’t have to build obfuscation into anything.