Secured Client-side Script

I have got a particular requirement where some critical algorithms have to be handled in the client-side script and it got to be secured. Using javascript will just expose the algo

Solution 1:

You CANNOT secure anything on a client PC.

Everything you are doing client-side is crackable and spuffable.

That's the PC of the client. It will be doing anything the client has requested it to do.

Solution 2:

Script is not secure, also what level of security do you need? If you download anything to the client the client will be able to look at the algorithim. Of course if you download a native dll, then decompiling it will be harder, the question is if this is good enough.

That an important thing most people miss when evaluating security nothing is trully 100% secure. Because your server admin could go in and steal the binaries off your server. And if your using third party hosting who knows who has access to the server.

The idea is to raise the bar. Do you want to prevent the average script kiddie? Obfuscate it, make it hard for them to understand the gain of understanding the algorithim might not justify the pain in trying to understand it.

The best that you can probally do is keep the algorithim on the server and expose it via a web service.

Solution 3:

Everything that the end-user is controlling to 100% may be tampered with, and this is especially true with JavaScript that is so easily exposed.

You are going down the wrong path. You need to rethink your approach.

Solution 4:

You could build a web-service containing the critical algorithm and call it from javascript.

Solution 5:

Bottom line is, if someone wants your logic ... they will get it unless it is server-side and they never obtain it in any way.

What you want is a Javascript obfuscator