0

So I realize that anyone can view the javascript in-line with HTML running in their browser, so if I use an external js library on my server will its contents be completely hidden?

Another question is are there any cases where it's better to use in-line javascript, like with jQuery or something, or is there really no down side to just using a js library for all of it?

Mogsdad
  • 44,709
  • 21
  • 151
  • 275
Cains
  • 883
  • 2
  • 13
  • 23
  • No. Open Developer Tools or Firebug, you can see all the scripts that are loaded, whether they're inline or external. – Barmar May 31 '13 at 01:24
  • 1
    possible duplicate of [How can I obfuscate(protect) JavaScript?](http://stackoverflow.com/questions/194397/how-can-i-obfuscateprotect-javascript) – Mogsdad Sep 17 '15 at 01:40

3 Answers3

4

No, there is no way that your javascript will ever be "hidden". Anything that can be run in a browser can be trivially saved and inspected. The best you can do is use an obfuscator.

The downside to using an external file is that it's another request. The upside is that it can be cached independently. For best performance, code that will be used from more than one page should be stored in its own file, and code that is page-specific is better off being stored within the page that uses it.

j__m
  • 9,392
  • 1
  • 32
  • 56
  • Would you say the best way to hide sensitive code or logic is in a php file that communicates with the javascript through AJAX/Web Sockets then? – Cains May 31 '13 at 01:32
  • 2
    Yes, proprietary logic belongs on the server. – j__m May 31 '13 at 01:35
1

JavaScript operates on the Browser level, that means that the browser at some point read your JS (external or internal same s.). You can easily conclude from this that if at some point the JS is now registered by the browser, and it's accessible by anyone with a bit more knowledge in web stuff. you'll not be able to hide your JS trickery.
Pus inside your JS a Copyright notice and pray.

Never send sensitive data through the yellow wire.
If you have some extra sensitive strings, encode and compare them on server side - sending them like MD5 or in some SHA model to the server.

Roko C. Buljan
  • 196,159
  • 39
  • 305
  • 313
0

Javascript, with the exception of something like node, operates client-side so you can't really use an "external js library" on your server, whatever that means.

Best practices dictate that you should almost always reference your javascript using <script> tags and link to your javascript file using the src attribute.

imjared
  • 19,492
  • 4
  • 49
  • 72
  • I suppose I have a little confusion here, but isn't technically all the code or libraries on a server, it's just being handed out to a client? I was probably thinking of somehow using AJAX with a javascript library, but I see how that doesn't really make sense. – Cains May 31 '13 at 01:30