deploying node.js in compiled form

Question

We are considering node.js for our next server side application. But we don't want our client to be able to look into our application's code. Can we deploy application written in node.js in compiled form? If yes, then how?

Answer 1

Maybe you could obfuscate all your code... I know this is not like compiling, but at least, it will avoid the 99% of the clients of looking at the code :D

Here is another topic: How can I obfuscate (protect) JavaScript?

good luck

Answer 2

But we don't want our client to be able to look into our application's code.

If you are shipping code to your client, they will be able to "look into your application's code". Technically, the process of "running your code" is "looking into your application's code".

Having a fully compiled version of your code can definitely feel "more safe", but they still have a copy of the code in some usable form. They can still reverse engineer pieces or do other things. This stuff really comes down to the license.

Here's a related answer. His quote is:

Write a license and get a lawyer to go after violators

Otherwise, you should host the stuff yourself and allow for public access.

Any form of obfuscation, minification, compilation is just going to be a speed bump on the way to "stealing your code". It's probably much better to simply have legal recourse.

Answer 3

I don't believe this is possible. I mean, technically I guess you could write everything as native C++ extensions, but that would defeat the purpose of using node.

Answer 4

As mentioned before, there is no true compilation in Node.js because the nod executable basically compiles javascript code on the fly.

A lot of developers use Google's Closure Compiler which really just "minify" -- removes comments, whitespaces, etc. -- and "optimize" -- converts javascript code to more efficient javascript. However, the resultant code is generally still parsable javascript code (albeit rather hard to read!). Check out this related stream for more info: Getting closure-compiler and Node.js to play nice

A couple of options that might be helpful:

1. Develop a custom module for "proprietary" business logic and host it on your secure servers
2. Wrap "proprietary" business logic into a java class or executable that is called as an external process in Node.js
3. Code "proprietary" business logic as compiled web services available on a separate application server that is called by Node.js.

It's up to you to define what part of your application should be considered "proprietary", but as a general rule I would not classify HTML and related javascript -- sent to the we browser -- as "proprietary". My advice is to be judicious here.

Lastly, I found the following stream with an interesting approach that might be helpful, but it is rather advanced and likely to be rather buggy: Secure distribution of NodeJS applications

Hope that helps...