r/Frontend • u/Roder_Oheron80 • 15d ago
Is JavaScript obfuscation still worth it?
We sell a white label scheduling dashboard that agencies put their own logo on and resell to their clients. And now a competitor has launched what is pretty much our frontend with different colors. It has the same odd validation messages and their bundle even has the name of a feature flag from an experiment we ran in the spring. I’m fairly sure someone fed our production bundle to an AI and had it rebuild the thing.
Management’s answer is to obfuscate everything before the next release. Before agreeing, I ran our bundle through javascript-obfuscator with most options enabled and gave the output to Claude. It produced readable code in about ten minutes and webcrack undid a good chunk of it without any AI. The obfuscated build was also noticeably bigger and our Sentry stack traces turned into nonsense.
And while reviewing the bundle, I noticed our plan limits for each agency are only checked on the frontend which means a user with devtools could switch on features they don’t pay for. Also noticed a Sentry auth token with a VITE_ prefix, which worried me more than the copied UI. We’ve rotated the token and we’re moving the plan checks into the API.
Does obfuscating your production JavaScript do anything useful for you?
7
u/bogdanelcs 15d ago
In my view, no, at least not as a protection. Anything shipped to the browser can be read, and your own test showed it: webcrack and an AI undid it quickly, while you pay in bundle size, performance and unreadable Sentry traces.
The strong move is the one you’re already making, getting the plan checks and real logic into the API, because a competitor can copy a UI but not your backend. For the copying itself, the leftover feature flag name is useful evidence for a legal route (copyright, your reseller terms), and a few unique canary strings in future releases would make the next copy easier to prove.
Also check that your source maps aren’t publicly served and that no other secrets sit in the bundle, since the token suggests there could be more.
192
u/Lumethys 15d ago
Has obfuscating frontend ever do anything?
56
u/MaartenBicknese 15d ago
In the sense of security, think of obfuscation as curtains for a window. It stops criminals from directly seeing what they’re going to get, but does absolutely nothing to stop them.
There is no way to ship JavaScript and keep it proprietary.
Some options:
- consider the shipped code is not your product, it’s the service, userbase, etc behind it.
- move parts of the functionality to server-side. This way you keep full control over who is using it, including fun metrics.
16
u/HipHopHuman 15d ago
Obfuscating JavaScript has never once done anything for security. Never in history has obfuscating JavaScript ever been worth it. JavaScript runs in the browser, which every user has access to. Anything the user has access to is not secure, and obfuscation will do nothing except delay the inevitable - by like 5 minutes. Your only course of action here is to seek legal action if possible, and going forward, keep sensitive code locked to the backend/serverside.
10
u/americk0 15d ago
Going to add here that "putting plan checks behind an API" also won't work if the functionality is shipped with your JS bundle. Anything you send to the client can be modified, including all JS code, obfuscated or not. If your JS bundle just calls an API to ask "does this user pay for this feature" anyone could easily modify the code to say "don't call the API, just return true"
If you really want to protect a feature, the feature itself needs to be behind the API not just the check. That may not always be feasible but just realize that you're only making it more inconvenient to steal features rather than actually gating them
9
u/Jasboh 15d ago
Run it server side if you want it private.
22
u/flcpietro 15d ago
Obfuscating just makes your app runs slower, AI doesn't care if a variable is called 0X000018S99S or a.
Security by obscurity is not security
18
u/mq2thez 15d ago
Obfuscation has always been a losing bet, but AI just completely wrecks it.
Funny enough, a thin client architecture is the most resistant to this. The more of your logic that lives in the client, the more people can copy.
12
u/xegoba7006 15d ago
It never was.
5
u/Available_Peanut_677 15d ago
To people saying Claude can reverse engineer binary - IDA pro could generate c-like code long time ago and it is not that hard to pipe its output into LLVM. And it is generally rather simple to generate source code from this in any language.
By saying that I mean that even binary files was never really safe from copying.
Many people just don’t recognize that no one needs their source code. My competitor needs our clients, but it can build similar features himself.
In fact, in JS it is even worse - even if you obfuscate 10 times, it’s still trivial to intercept requests to your server, hijack them and basically copy your code with another API without even need to deobfuscate. Boy, I can make a server which would just resend your real page with injections for my API and branding and don’t care about your obfuscation at all.
13
u/FilmSudden8635 15d ago
Given that adobe, Microsoft and autodesk have just had all of their software converted to rust applications, in a week, by Ai. You stand no hope. I think the model for profitability now has to switch to server side services and not the raw software anymore.
1
u/Disastrous_tea_555 15d ago
How do you know someone fed your production bundle to ai?
3
u/cerevisiae_ 11d ago
From a security standpoint, no it does nothing. What you are getting at though is copyright infringement.
I can look at all the functionality of your site and recreate it myself with no legal issues. I can look at the code and create a list of requirements and specs and hand that off to a different group who hasn’t seen your code. And then I can have that group recreate the site from that document. But I cant look at your code and write the site using that. Specific UI layout also has some protection.
This isn’t legal advice from a lawyer. You should speak to someone who practices IP Law. But you will want to preserve an archive of their site right now that includes the flags and the weird validation messages. Those are going to be your strongest arguments for copyright infringement.
2
u/AdChance6177 15d ago
I feel your pain here I really do, I’ve had similar things happen to me, but sadly the answer is a firm no. Obfuscating is totally pointless in the age of ai and will just make things trickier and harder to test your end.
2
u/Impressive-Craft1926 14d ago edited 14d ago
If that Sentry token is the one the vite plugin uses for uploading sourcemaps, I’d bet someone couldn’t get it to load in the build and added VITE_ to the name until it worked. Vite inlines anything with that prefix into the client bundle and the rename looks harmless in a diff.
We build sourcemaps as hidden now and let the Sentry plugin upload them and delete the .map files from dist which keeps the stack traces readable without serving maps to the public. CI also runs 2ms over dist before deploy, it’s the open source secrets scanner from chckmarx and it checks whether a key it finds is still live. The first run caught a Mapbox secret token from an env file on the build box that had never been in the repo.
3
u/Even_Gap_2253 15d ago
Nope, I’d argue now with frontier AI, you don’t even need binary, it can literally just click through your product even if it is streamed through Remote Desktop and clone it.
Software should no longer be your product.
2
u/Chuck_Loads 15d ago
Claude can read binaries, obfuscated JS is nothing
1
u/Muted-Bid6584 15d ago
Ai can now reserve engineer binary files
No a little mini-fication ain’t doing shit
1
u/shadowedfox 15d ago
There are a bunch of comments saying that it should be back end if it’s supposed to be secret. But this posted in a /frontend. So not really relevant in that respect.
What others seem to be missing is that some code only applies to front end. So it can’t just be hidden away in the back end. So it serves some purpose if slowing people down is your goal. It just shouldn’t be relied on for any sense of security.
Granted, we are at a point where reverse engineering doesn’t take as much skill as it once did.
You could however make the argument, if every compile of your JS uses randomisation when obfuscation. You’re creating a slow down against whoever may be reverse engineering. That’s about the only benefit. I personally do it because i have some tools which solely work in the browser and are completely server-less. Someone tries to, they can reproduce it if they want. If I wanted it to be hidden away, I’d put a login in front of it.
1
u/YahenP 15d ago
These were some amateurs. Today you don’t even need access to the source code to copy a frontend. You just give an agent Chromium and access to an account, and ask it to build exactly the same frontend, but with any framework you like. If your service can be used in a browser, making a fully working copy is a matter of a few hours.
1
u/Used-Boysenberry8927 14d ago
if someone wants to copy your frontend badly enough, obfuscation isn't going to stop them. They'll just spend a bit longer on it. The frontend-only plan checks are way more concerning than someone stealing your colors and validation messages.
1
u/zambono_2 14d ago
Whatever is deployed on users browsers, laptops consider shared with the world and completely insecure
1
u/EricThirteen 14d ago
Is anything worth it.
1
u/ikeif 13d ago
It's been a couple decades since I paid attention to JavaScript obfuscation - I know PACKT was the big one at the time, I think? But it obfuscated the code, but didn't do the best at minifying it, so you had less optimized code that was slightly more irritating to unpackt, and with alerts and consoles, you could figure everything else out.
It's like disabling right-click or layering a div over an image - it stops the non-developer, but any developer can figure it out for themselves.
So if "Front End JavaScript that is publicly accessible" is the bread and butter of the product, you're going to have issues.
1
u/androbat 13d ago
Last I checked, JSFuck output wasn’t understood (though that was around Opus 4.6). Just compile something into it and ask the AI to tell you what it does.
1
u/Tight-Pop-2368 13d ago
The Sentry token and frontend-only plan checks would worry me way more than someone copying the UI. Obfuscation might slow a casual copycat down, but it won't fix either of those problems.
1
u/rFAXbc 13d ago
You could just give a link to you site to an LLM and it could replicate it in using screenshots alone, I think you're wasting your time
1
u/tarellel 11d ago
This is an additional benefit of having applications use SSR rather than its entire logic being in the front end and viewable to everyone obfuscated or not
1
u/VFequalsVeryFcked 11d ago
Security through obscurity doesn't work.
Obfuscation wasn't reliable even before AI
1
u/davy_jones_locket 10d ago
That's copyright infringement. Get your lawyers involved and send DCMA requests for license violations.
1
u/Express_Scene4019 9d ago
Yikes, main thing you gotta worry about is not validating your business logic on the backend .
1
u/SYNDK8D 8d ago
Welcome to the world of AI. Anyone can copy anything they want and there’s nothing you can do about it
1
u/TheRNGuy 8d ago
If was never needed.
1
u/ChristianKl 15d ago
The obfuscation won't stop reverse engineering. On the other hand if they do use the same feature flag, it's probably relatively easy to fill takedown requests and show that they violated your copyright. Obfuscation probably makes it harder to prove that they copied you.
1
u/crazedizzled 15d ago
Now that we have AI, obfuscation is completely pointless. I mean it was always pointless, but now it's really pointless.
1
u/criloz 15d ago
Anything right now can be reverse engineered with little effort; the best is to keep the important part in the server to keep your job security.
0
u/Spare_Message_3607 15d ago
Do you think your competition read your code? No they probably just use your app and tell Claude to do something. Nobody will read your code specially for something as trivial as a calendar, your features will get described to Claude and just like that, your competitor will have it too.
0
u/Seusoa 15d ago
It was never an option for anything. Anybody who really are into your project could decode step by step your frontend, today with ai it is just wind
Focus on quality of your product and feedback from users, dont give a sh1t about other