How to secure commercial javascript library in front-end
up vote
0
down vote
favorite
CONTEXT
I am developing a web application with RAILS as the API-JSON backend with React in front-end. Recently, we need to integrate a commercial Javascript library which requires to be initialized at the client-side. I need to input the license key during the initialization process, which I have 2 options from their API:
- Use the license key directly:
commercialLib.setup(configWithLicense);
- Via license file URL:
commercialLib.setup(configWithLicenseURL);
Apparently, I don't want the first options since it can easily expose the license. However, with even with the latter, the license file content can easily read via the browser developer tool.
One more thing makes me confused is the vendor has their demo/sample page, which they are using the second approach (they sent me the source as an example for using, and also I can easily check the javascript source with the developer tool). But in their site, the request to the license file URL is not displayed, and I absolutely have no idea how they do that.
QUESTION
How can I secure my license in this scenario? And how could I hide a browser request from being traced in the developer tool?
ruby-on-rails reactjs
asked Nov 7 at 15:02
Firice Nguyen
1,231715
add a comment |
up vote
0
down vote
favorite
CONTEXT
I am developing a web application with RAILS as the API-JSON backend with React in front-end. Recently, we need to integrate a commercial Javascript library which requires to be initialized at the client-side. I need to input the license key during the initialization process, which I have 2 options from their API:
- Use the license key directly:
commercialLib.setup(configWithLicense);
- Via license file URL:
commercialLib.setup(configWithLicenseURL);
Apparently, I don't want the first options since it can easily expose the license. However, with even with the latter, the license file content can easily read via the browser developer tool.
One more thing makes me confused is the vendor has their demo/sample page, which they are using the second approach (they sent me the source as an example for using, and also I can easily check the javascript source with the developer tool). But in their site, the request to the license file URL is not displayed, and I absolutely have no idea how they do that.
QUESTION
How can I secure my license in this scenario? And how could I hide a browser request from being traced in the developer tool?
ruby-on-rails reactjs
asked Nov 7 at 15:02
Firice Nguyen
1,231715
You can't hide a request or anything that is sent to the client. Anything that goes across the wire can be read by the client.
– max
Nov 8 at 15:28
Yes, AFIK it is impossible, but according to the sample code that I inspected in the vendor's sample webpage (which they also sent me that) it's happening. Could you help me with the other question (the one about secure javascript library license) ?
– Firice Nguyen
Nov 8 at 19:24
You can't really hide anything - I'm guessing the company in question is delusional, full of $hit or they are just using some form of obfuscation. When using API's for example this is handled by using non-secret API keys for javascript SDKs.
– max
Nov 8 at 19:29
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
CONTEXT
I am developing a web application with RAILS as the API-JSON backend with React in front-end. Recently, we need to integrate a commercial Javascript library which requires to be initialized at the client-side. I need to input the license key during the initialization process, which I have 2 options from their API:
- Use the license key directly:
commercialLib.setup(configWithLicense);
- Via license file URL:
commercialLib.setup(configWithLicenseURL);
Apparently, I don't want the first options since it can easily expose the license. However, with even with the latter, the license file content can easily read via the browser developer tool.
One more thing makes me confused is the vendor has their demo/sample page, which they are using the second approach (they sent me the source as an example for using, and also I can easily check the javascript source with the developer tool). But in their site, the request to the license file URL is not displayed, and I absolutely have no idea how they do that.
QUESTION
How can I secure my license in this scenario? And how could I hide a browser request from being traced in the developer tool?
ruby-on-rails reactjs
asked Nov 7 at 15:02
Firice Nguyen
1,231715
CONTEXT
I am developing a web application with RAILS as the API-JSON backend with React in front-end. Recently, we need to integrate a commercial Javascript library which requires to be initialized at the client-side. I need to input the license key during the initialization process, which I have 2 options from their API:
- Use the license key directly:
commercialLib.setup(configWithLicense);
- Via license file URL:
commercialLib.setup(configWithLicenseURL);
Apparently, I don't want the first options since it can easily expose the license. However, with even with the latter, the license file content can easily read via the browser developer tool.
One more thing makes me confused is the vendor has their demo/sample page, which they are using the second approach (they sent me the source as an example for using, and also I can easily check the javascript source with the developer tool). But in their site, the request to the license file URL is not displayed, and I absolutely have no idea how they do that.
QUESTION
How can I secure my license in this scenario? And how could I hide a browser request from being traced in the developer tool?
ruby-on-rails reactjs
ruby-on-rails reactjs
asked Nov 7 at 15:02
Firice Nguyen
1,231715
asked Nov 7 at 15:02
Firice Nguyen
1,231715
asked Nov 7 at 15:02
Firice Nguyen
1,231715
asked Nov 7 at 15:02
Firice Nguyen
1,231715
asked Nov 7 at 15:02
Firice Nguyen
1,231715
1,231715
You can't hide a request or anything that is sent to the client. Anything that goes across the wire can be read by the client.
– max
Nov 8 at 15:28
Yes, AFIK it is impossible, but according to the sample code that I inspected in the vendor's sample webpage (which they also sent me that) it's happening. Could you help me with the other question (the one about secure javascript library license) ?
– Firice Nguyen
Nov 8 at 19:24
You can't really hide anything - I'm guessing the company in question is delusional, full of $hit or they are just using some form of obfuscation. When using API's for example this is handled by using non-secret API keys for javascript SDKs.
– max
Nov 8 at 19:29
add a comment |
You can't hide a request or anything that is sent to the client. Anything that goes across the wire can be read by the client.
– max
Nov 8 at 15:28
Yes, AFIK it is impossible, but according to the sample code that I inspected in the vendor's sample webpage (which they also sent me that) it's happening. Could you help me with the other question (the one about secure javascript library license) ?
– Firice Nguyen
Nov 8 at 19:24
You can't really hide anything - I'm guessing the company in question is delusional, full of $hit or they are just using some form of obfuscation. When using API's for example this is handled by using non-secret API keys for javascript SDKs.
– max
Nov 8 at 19:29
You can't hide a request or anything that is sent to the client. Anything that goes across the wire can be read by the client.
– max
Nov 8 at 15:28
You can't hide a request or anything that is sent to the client. Anything that goes across the wire can be read by the client.
– max
Nov 8 at 15:28
Yes, AFIK it is impossible, but according to the sample code that I inspected in the vendor's sample webpage (which they also sent me that) it's happening. Could you help me with the other question (the one about secure javascript library license) ?
– Firice Nguyen
Nov 8 at 19:24
Yes, AFIK it is impossible, but according to the sample code that I inspected in the vendor's sample webpage (which they also sent me that) it's happening. Could you help me with the other question (the one about secure javascript library license) ?
– Firice Nguyen
Nov 8 at 19:24
You can't really hide anything - I'm guessing the company in question is delusional, full of $hit or they are just using some form of obfuscation. When using API's for example this is handled by using non-secret API keys for javascript SDKs.
– max
Nov 8 at 19:29
You can't really hide anything - I'm guessing the company in question is delusional, full of $hit or they are just using some form of obfuscation. When using API's for example this is handled by using non-secret API keys for javascript SDKs.
– max
Nov 8 at 19:29
add a comment |
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53192100%2fhow-to-secure-commercial-javascript-library-in-front-end%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
You can't hide a request or anything that is sent to the client. Anything that goes across the wire can be read by the client.
– max
Nov 8 at 15:28
Yes, AFIK it is impossible, but according to the sample code that I inspected in the vendor's sample webpage (which they also sent me that) it's happening. Could you help me with the other question (the one about secure javascript library license) ?
– Firice Nguyen
Nov 8 at 19:24
You can't really hide anything - I'm guessing the company in question is delusional, full of $hit or they are just using some form of obfuscation. When using API's for example this is handled by using non-secret API keys for javascript SDKs.
– max
Nov 8 at 19:29