如何在网页中隐藏JavaScript代码？ [重复]

This question already has an answer here:

这个问题在这里已有答案：

how to hide javascript code [duplicate] 4 answers
如何隐藏javascript代码[重复] 4个答案

Is it possible to hide the Javascript code from the html of a webpage, when the source code is viewed through the browsers View Source feature?

当通过浏览器查看源功能查看源代码时，是否可以从网页的html中隐藏Javascript代码？

I know it is possible to obfuscate the code, but I would prefer it being hidden from the view source feature.

我知道可以对代码进行模糊处理，但我更希望它从视图源功能中隐藏。

9 个解决方案

#1

I'm not sure anyone else actually addressed your question directly which is code being viewed from the browser's View Source command.

我不确定其他人是否直接解决了您的问题，这是从浏览器的View Source命令查看的代码。

As other have said, there is no way to protect javascript intended to run in a browser from a determined viewer. If the browser can run it, then any determined person can view/run it also.

正如其他人所说，没有办法保护打算在浏览器中运行的javascript来自确定的查看者。如果浏览器可以运行它，那么任何确定的人也可以查看/运行它。

But, if you put your javascript in an external javascript file that is included with:

但是，如果你将你的javascript放在一个外部的javascript文件中，该文件包含在：

<script type="text/javascript" src="http://mydomain.com/xxxx.js"></script>

tags, then the javascript code won't be immediately visible with the View Source command - only the script tag itself will be visible that way. That doesn't mean that someone can't just load that external javascript file to see it, but you did ask how to keep it out of the browser's View Source command and this will do it.

标签，然后使用“查看源”命令不会立即显示javascript代码 - 只有脚本标记本身才会以这种方式显示。这并不意味着有人不能只是加载外部javascript文件来查看它，但你确实问过如何将它保持在浏览器的View Source命令之外，这样就可以了。

If you wanted to really make it more work to view the source, you would do all of the following:

如果您想真正让查看源代码更加有效，您可以执行以下所有操作：

Put it in an external .js file.
将它放在外部.js文件中。
Obfuscate the file so that most native variable names are replaced with short versions, so that all unneeded whitespace is removed, so it can't be read without further processing, etc...
对文件进行模糊处理，以便将大多数本机变量名称替换为短版本，以便删除所有不需要的空格，因此无需进一步处理就无法读取等等...
Dynamically include the .js file by programmatically adding script tags (like Google Analytics does). This will make it even more difficult to get to the source code from the View Source command as there will be no easy link to click on there.
通过以编程方式添加脚本标记来动态地包含.js文件（如Google Analytics一样）。这将使得从View Source命令获取源代码变得更加困难，因为没有简单的链接可以点击那里。
Put as much interesting logic that you want to protect on the server that you retrieve via ajax calls rather than do local processing.
在您通过ajax调用检索的服务器上放置要保护的有趣逻辑，而不是进行本地处理。

With all that said, I think you should focus on performance, reliability and making your app great. If you absolutely have to protect some algorithm, put it on the server, but other than that, compete on being the best at you do, not by having secrets. That's ultimately how success works on the web anyway.

尽管如此，我认为您应该专注于性能，可靠性并使您的应用程序变得更好。如果你绝对必须保护一些算法，把它放在服务器上，但除此之外，争取做你最好的，而不是有秘密。无论如何，这最终取决于网络上的成功。

#2

No, it isn't possible.

不，这是不可能的。

If you don't give it to the browser, then the browser doesn't have it.

如果您没有将它提供给浏览器，那么浏览器就没有它。

If you do, then it (or an easily followed reference to it) forms part of the source.

如果你这样做，那么它（或一个容易遵循它的引用）构成了源的一部分。

#3

Use Html Encrypter The part of the Head which has

使用Html Encrypter Head的部分有

<link rel="stylesheet" href="styles/css.css" type="text/css" media="screen" />
<script type="text/javascript" src="script/js.js" language="javascript"></script>

copy and paste it to HTML Encrypter and the Result will goes like this
and paste it the location where you cut the above sample

<Script Language='Javascript'>
<!-- HTML Encryption provided by iWEBTOOL.com -->
<!--
document.write(unescape('%3C%6C%69%6E%6B%20%72%65%6C%3D%22%73%74%79%6C%65%73%68%65%65%74%22%20%68%72%65%66%3D%22%73%74%79%6C%65%73%2F%63%73%73%2E%63%73%73%22%20%74%79%70%65%3D%22%74%65%78%74%2F%63%73%73%22%20%6D%65%64%69%61%3D%22%73%63%72%65%65%6E%22%20%2F%3E%0A%3C%73%63%72%69%70%74%20%74%79%70%65%3D%22%74%65%78%74%2F%6A%61%76%61%73%63%72%69%70%74%22%20%73%72%63%3D%22%73%63%72%69%70%74%2F%6A%73%2E%6A%73%22%20%6C%61%6E%67%75%61%67%65%3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%3C%2F%73%63%72%69%70%74%3E%0A'));
//-->

HTML ENCRYPTER Note: if you have a java script in your page try to export to .js file and make it like as the example above.

HTML ENCRYPTER注意：如果您的页面中有一个java脚本，请尝试导出到.js文件，并使其像上面的示例一样。

And Also this Encrypter is not always working in some code that will make ur website messed up... Select the best part you want to hide like for example in <form> </form>

而且这个加密器并不总是在一些代码中使用，这将使你的网站搞砸了...选择你想隐藏的最好的部分，例如在

This can be reverse by advance user but not all noob like me knows it.

这可以通过提前用户反向，但不是像我这样的所有菜鸟都知道。

Hope this will help

希望这会有所帮助

#4

My solution is inspired from the last comment. This is the code of invisible.html

我的解决方案受到最后评论的启发。这是invisible.html的代码

<script src="http://code.jquery.com/jquery-1.8.2.js"></script>
<script type="text/javascript" src="invisible_debut.js" ></script>
<body>
</body>

The clear code of invisible_debut.js is:

invisible_debut.js的明确代码是：

$(document).ready(function () {
var ga = document.createElement("script"); //ga is to remember Google Analytics ;-)
ga.type = 'text/javascript';
ga.src = 'invisible.js';
ga.id = 'invisible';
document.body.appendChild(ga);
$('#invisible').remove();});

Notice that at the end I'm removing the created script. invisible.js is:

请注意，最后我将删除创建的脚本。 invisible.js是：

$(document).ready(function(){
    alert('try to find in the source the js script which did this alert!');
    document.write('It disappeared, my dear!');});

invisible.js doesn't appear in the console, because it has been removed and never in the source code because created by javascript.

invisible.js不会出现在控制台中，因为它已被删除，并且从未在源代码中出现，因为它是由javascript创建的。

Concerning invisible_debut.js, I obfuscated it, which means that it is very complicated to find the url of invisible.js. Not perfect, but enought hard for a normal hacker.

关于invisible_debut.js，我对它进行了模糊处理，这意味着找到invisible.js的url非常复杂。不完美，但对正常的黑客来说很难。

#5

I'm not sure there's a way to hide that information. No matter what you do to obfuscate or hide whatever you're doing in JavaScript, it still comes down to the fact that your browser needs to load it in order to use it. Modern browsers have web debugging/analysis tools out of the box that make extracting and viewing scripts trivial (just hit F12 in Chrome, for example).

我不确定是否有办法隐藏这些信息。无论你做什么来混淆或隐藏你在JavaScript中做的任何事情，它仍然归结为你的浏览器需要加载它才能使用它。现代浏览器具有开箱即用的Web调试/分析工具，使得提取和查看脚本变得微不足道（例如，只需在Chrome中点击F12）。

If you're worried about exposing some kind of trade secret or algorithm, then your only recourse is to encapsulate that logic in a web service call and have your page invoke that functionality via AJAX.

如果您担心暴露某种商业秘密或算法，那么您唯一的办法是将该逻辑封装在Web服务调用中，并让您的页面通过AJAX调用该功能。

#6

'Is not possible!'

'不可能！'

Oh yes it is ....

哦，是的......

//------------------------------
function unloadJS(scriptName) {
  var head = document.getElementsByTagName('head').item(0);
  var js = document.getElementById(scriptName);
  js.parentNode.removeChild(js);
}


//----------------------
function unloadAllJS() {
  var jsArray = new Array();
  jsArray = document.getElementsByTagName('script');
  for (i = 0; i < jsArray.length; i++){
    if (jsArray[i].id){
      unloadJS(jsArray[i].id)
    }else{
      jsArray[i].parentNode.removeChild(jsArray[i]);
    }
  }      
}

#7

You could use document.write.

你可以使用document.write。

Without jQuery

没有jQuery

<!DOCTYPE html>
<html>
<head><meta charset=utf-8></head>
<body onload="document.write('<!doctype html><html><head><meta charset=utf-8></head><body><p>You cannot find this in the page source. (Your page needs to be in this document.write argument.)</p></body></html>');">
</body></html>

Or with jQuery

或者使用jQuery

$(function () {
  document.write("<!doctype html><html><head><meta charset=utf-8></head><body><p>You cannot find this in the page source. (Your page needs to be in this document.write argument.)</p></body></html>")
});

#8

I think I found a solution to hide certain JavaScript codes in the view source of the browser. But you have to use jQuery to do this.

我想我找到了一个解决方案来隐藏浏览器视图源中的某些JavaScript代码。但你必须使用jQuery来做到这一点。

For example:

例如：

In your index.php

在你的index.php中

<head>
<script language = 'javascript' src = 'jquery.js'></script>
<script language = 'javascript' src = 'js.js'></script>
</head>

<body>
<a href = "javascript:void(null)" onclick = "loaddiv()">Click me.</a>

<div id = "content">
</div>

</body>

You load a file in the html/php body called by a jquery function in the js.js file.

您在js.js文件中的jquery函数调用的html / php主体中加载文件。

js.js

function loaddiv()
{$('#content').load('content.php');}

Here's the trick.

这是诀窍。

In your content.php file put another head tag then call another js file from there.

在你的content.php文件中放入另一个头标记，然后从那里调用另一个js文件。

content.php

<head>
<script language = 'javascript' src = 'js2.js'></script>
</head>

<a href = "javascript:void(null)" onclick = "loaddiv2()">Click me too.</a>

<div id = "content2">
</div>

in the js2.js file create any function you want.

在js2.js文件中创建您想要的任何功能。

example:

例：

js2.js

function loaddiv2()
{$('#content2').load('content2.php');}

content2.php

<?php
echo "Test 2";
?>

Please follow link then copy paste it in the filename of jquery.js

请按照链接然后将其粘贴到jquery.js的文件名中

http://dl.dropbox.com/u/36557803/jquery.js

I hope this helps.

我希望这有帮助。

#9

Is not possbile!

不可能！

The only way is to obfuscate javascript or minify your javascript which makes it hard for the end user to reverse engineer. however its not impossible to reverse engineer.

唯一的方法是混淆javascript或缩小你的javascript，这使得最终用户很难进行逆向工程。然而逆向工程并非不可能。

#1