Recently I was working on a project involving javascript-obfuscator/javascript-obfuscator:, and I thought it'd be helpful to share some insights.

Ready to learn more? Subscribe to our newsletter for weekly tutorials and tips.

正文

🚀 Obfuscator.io with VM Obfuscation is out! VM-based bytecode obfuscation

— the most advanced code protection available. Your JavaScript functions are transformed into custom bytecode running on an embedded virtual machine, making reverse engineering extremely difficult.

This package provides access to Obfuscator.io Pro API via CLI and Node.js API.

JavaScript Obfuscator is a powerful free obfuscator for JavaScript, containing a variety of features which provide protection for your source code. VM bytecode obfuscation (via

strings extraction and encryption various code transformations

The example of obfuscated code: gulp-javascript-obfuscator

rollup-plugin-javascript-obfuscator netlify-plugin-js-obfuscator

snowpack-javascript-obfuscator vite-plugin-bundle-obfuscator

NOTE! the README on the master branch might not match that of the latest stable release!

It is not recommended to obfuscate vendor scripts and polyfills, since the obfuscated code is 15-80% slower (depends on options) and the files are significantly larger.

Install the package with Yarn or NPM and add it to your

https://cdn.jsdelivr.net/npm/javascript-obfuscator/dist/index.browser.js

./node_modules/javascript-obfuscator/dist/index.browser.js var variable3 = '5' + - '2';

var variable4 = ['10','10','10','10','10'].map(parseInt);

_0x338a69 = _0x338a69 - (0x1939 + -0xf * 0x1f3 + 0x1 * 0x469);

More Details

There are a few more points worth noting. First, browser compatibility varies across different browsers. Second, performance optimization is crucial when handling large amounts of data. Finally, key management is also an important consideration.

Feel free to ask questions in the comments - I'll reply as soon as possible.

Reference: javascript-obfuscator/javascript-obfuscator: A powerful ... - GitHub

I've had several readers ask me about Front-End recently, so I decided to write a comprehensive article about it.

Want to learn advanced techniques? Check out our premium courses.

正文

Front-End Security: 10 Popular Types of Attacks and Best Practices to Prevent Them

Your web application's front end is the first part seen everywhere. It’s the first thing that regular users and potential customers look at but it’s also the first thing that an attacker sees—it's the main door to your

Front-end security demands have increased a lot over the past decade. There are more sophisticated attacks taking place against web application front ends these days, whereas in the past most attacks were straightforward, resulting in easier detection. More recently, attacks have become stealthier, harder to detect, and often discovered far too late.

Employing proactive techniques, like engaging security from the start, reducing

, and nurturing a healthy cybersecurity culture within an organization, can help reduce the attack surface of any web application's front end.

Top 10 Front-End Security Risks and Best Practices to Prevent Them

Let's look at some popular front-end security issues, and how you can fight different

to prevent them with the industry's best practices.

XSS attacks are one of the largest and most dangerous forms of attack. They're crafted in such a way that they inject code into a web application, which ends up performing malicious actions when accessed by an end user.

XSS attacks are drawn to a lack of sanitization in a web application's input and output, which can lead to a variety of attacks.

rank as one of the largest types of attacks under the XSS attack umbrella, as they're simply performed by replacing legitimate parts of a web page with similar-looking, yet dangerous, elements. For example, checkout buttons can be replaced with buttons redirecting users to

, legitimate download buttons can be replaced with buttons resulting in malware downloads, and more.

With XSS attacks, an attacker can inject JavaScript libraries, which then execute on the client side—logging the user's IP address, geolocation and other personal details. These can then be used by the attacker to target the end user with personalized scams or

With code injected by an XSS attack, cryptomining can be performed on end users' devices as well. While it may already seem to slow down a single device, hundreds or thousands of users visiting a web application every day means crypto mining scripts running on your web application can unknowingly cause not only slowdowns but also heating issues on users' devices. This sort of effect on your web application can lead to a negative experience on their part.

Protection against XSS attacks can be achieved by the proper sanitization of inputs made into your web application, as well as by filtering inputs correctly. For example, limiting mobile numbers to digits only or not allowing special characters in names can yield a substantial benefit by preventing most injection attacks on your web application.

More Details

There are a few more points worth noting. First, browser compatibility varies across different browsers. Second, performance optimization is crucial when handling large amounts of data. Finally, key management is also an important consideration.

Feel free to ask questions in the comments - I'll reply as soon as possible.

Reference: Front-End Security: 10 Popular Types of Attacks and Best Practices ...

关于What，网上资料比较零散，这里做个相对完整的总结。

Want to learn advanced techniques? Check out our premium courses.

正文

对身份验证密钥使用安全Cookie。JavaScript无法访问它们，因此脚本注入攻击无法窃取它们。避免任何

在现代Web开发中，What变得越来越重要。开发者需要了解相关的安全 implications 和最佳实践。

实现What时，有几个关键考虑因素。首先是性能优化——复杂的计算可能会阻塞主线程，影响用户体验。其次是安全性，必须在应用的每一层都考虑到。

许多开发者忽视了适当的错误处理和调试技术的重要性。浏览器开发者工具、日志框架和监控服务可以显著改善开发流程。

What相关的生态系统发展迅速。新库和新框架 regularly 出现，每个都有各自解决常见问题的方法。

测试是另一个关键方面，不容忽视。自动化测试、代码审查和安全审计有助于确保代码库的质量和可靠性。

更多内容

除了上面提到的内容，还有几个点值得注意。首先是浏览器的兼容性，不同浏览器对Web Crypto API的支持程度有所不同。其次是性能问题，加密操作在大量数据时可能会影响用户体验。最后是密钥管理，如何安全地存储和传输密钥也是一个需要考虑的问题。

篇幅原因就先写这么多，后面有空会再补充更多实战案例。有问题评论区见。

Reference: What about security? : r/Frontend - Reddit

不少同学在群里讨论JavaScript，这里统一回复一下，顺便整理成文章。

Have questions? Feel free to ask in the comments section below.

正文

JavaScript代码加密是保护前端源代码安全的重要方法。我们的

JSVMP （ JavaScript虚拟机保护）加密工具

保护技术，以有效防止代码被反编译、反向工程和

防止您的代码逻辑和算法被竞争对手窃取

Significantly increase reverse engineering difficulty

保护敏感数据，如API密钥和配置

维护核心业务代码价值并保持竞争力

JSVMP加密技术功能虚拟机保护：

内置反调试、反挂钩和反仪表灵活加密级别：

支持主流浏览器和Node.js环境

准备JavaScript代码（建议使用ES5语法）

调整加密难度滑块（ 0-3级，推荐1-2级）

JSVMP的虚拟机保护技术显著增加了

破解，有效防止大多数逆向工程攻击。

根据您的需求选择适当的加密级别：对性能敏感的0-1级

更多内容

除了上面提到的内容，还有几个点值得注意。首先是浏览器的兼容性，不同浏览器对Web Crypto API的支持程度有所不同。其次是性能问题，加密操作在大量数据时可能会影响用户体验。最后是密钥管理，如何安全地存储和传输密钥也是一个需要考虑的问题。

有问题欢迎评论区交流，看到会第一时间回复大家一起讨论。

Reference: JavaScript Code Encryption, Compression & Obfuscation Tool

关于hakonharnes/wasm-obf，网上资料比较零散，这里做个相对完整的总结。

Ready to learn more? Subscribe to our newsletter for weekly tutorials and tips.

正文

此存储库包含来自WebAssembly混淆研究的源代码和实验数据。

它是作为我在挪威科技大学（ NTNU ）计算机科学硕士论文的一部分开发的。该论文可以找到

包含近50,000个WebAssembly二进制文件的实验数据可以在

包含用于创建论文中使用的绘图的数据和代码。

包含数据集中应用程序的源代码和构建文件。

包含密码挖掘检测方法的源代码。

包含用于测量WebAssembly二进制文件之间的文件大小、哈希率和相似性的代码。

包含用于混淆WebAssembly二进制文件的代码。

包含用于优化WebAssembly二进制文件的代码。

包含用于验证加密挖掘WebAssembly二进制文件的哈希的代码。

一些docker容器需要设置特定的网络。

具体来说，需要创建一个数据库、矿工和WASim网络：

docker network创建wasim_network docker compose run mongodb

数据库必须在运行实验之前运行。

这将使用Emscripten在数据集文件夹中构建应用程序，并将WebAssembly二进制文件以及随附的JavaScript胶水代码和HTML文件移至二进制文件文件夹。

更多内容

除了上面提到的内容，还有几个点值得注意。首先是浏览器的兼容性，不同浏览器对Web Crypto API的支持程度有所不同。其次是性能问题，加密操作在大量数据时可能会影响用户体验。最后是密钥管理，如何安全地存储和传输密钥也是一个需要考虑的问题。

篇幅原因就先写这么多，后面有空会再补充更多实战案例。有问题评论区见。

Reference: hakonharnes/wasm-obf - GitHub

项目中遇到了Shielding的需求，查阅了不少资料，给大家分享下我的方案。

Want to learn advanced techniques? Check out our premium courses.

正文

New JavaScript and Web Development content every day. **As web developers, we share a common understanding:** frontend code, inherently exposed, is accessible to anyone. Today’s article delves into common methods employed to prevent unauthorized debugging of frontend code. **Important Note:** For this article, we’ll skip the common practices of disabling right-click context menus, blocking the F12 key, and traditional code obfuscation. A persistent debugger loop can create a frustrating experien

When it comes to Shielding, understanding the fundamentals is crucial for any developer. This guide will walk you through the key concepts and practical applications.

One of the most important aspects of Shielding is security. In today's digital landscape, protecting user data and preventing unauthorized access should be top priorities for every project.

Performance optimization is another critical factor. Efficient code not only provides better user experience but also reduces server costs and improves scalability.

Modern development practices emphasize modularity and reusability. By breaking down complex systems into smaller, manageable components, teams can collaborate more effectively and maintain codebases more easily.

Testing should never be overlooked. Comprehensive test coverage helps catch bugs early and ensures that changes don't break existing functionality.

Documentation is equally important. Well-documented code is easier to understand, maintain, and extend by team members both present and future.

Version control systems have revolutionized how developers collaborate. Understanding Git workflows and best practices is essential for modern software development.

Continuous integration and deployment pipelines help automate the build, test, and release processes, reducing human error and speeding up delivery cycles.

Monitoring and logging provide visibility into production systems, enabling quick identification and resolution of issues before they impact users.

The devOps culture promotes collaboration between development and operations teams, breaking down silos and improving overall efficiency.

更多内容

除了上面提到的内容，还有几个点值得注意。首先是浏览器的兼容性，不同浏览器对Web Crypto API的支持程度有所不同。其次是性能问题，加密操作在大量数据时可能会影响用户体验。最后是密钥管理，如何安全地存储和传输密钥也是一个需要考虑的问题。

以上就是关于这个话题的完整分享，希望能对大家有所帮助。如果还有其他问题，欢迎在评论区留言讨论。

Reference: Shielding Your Frontend: Combatting Unwanted Debugging 🛡️

在做前端安全相关需求时，CAST-256-224这个问题绕不开，刚好把踩坑经验分享一下。

Ready to learn more? Subscribe to our newsletter for weekly tutorials and tips.

正文

Welcome to our comprehensive guide on CAST-256-224 encryption using JavaScript in the browser! In this article, you will discover the essentials of CAST-256-224, a powerful encryption algorithm designed for secure data transmission. We’ll explore how you can implement this encryption method directly in your web applications, enhancing the security of sensitive information online. Whether you’re a beginner looking to understand encryption concepts or a developer eager to integrate robust security features into your projects, this page will provide you with step-by-step instructions, code examples, and best practices. Dive in to unlock the potential of secure web development today! Introduction to CAST-256-224

CAST-256-224 is a symmetric key block cipher that is part of the CAST encryption family. Designed to work with a block size of 256 bits and a key size of 224 bits, CAST-256-224 is known for its efficiency and security. This encryption algorithm is ideal for applications that require a balance between performance and robust data protection. With increasing concerns about data privacy and security, implementing CAST-256-224 in web applications, particularly through JavaScript in the browser, has become increasingly relevant.

Encrypting Data with CAST-256-224 in JavaScript in Browser

Encrypting data using CAST-256-224 in JavaScript can be achieved with the help of various libraries. To encrypt data in the browser, developers can utilize libraries like

that provide a straightforward interface for implementing encryption algorithms.

Here is a simple example of how to encrypt data using CAST-256-224 in JavaScript:

// Encrypt the data using CAST-256-224 (dataToEncrypt, secretKey).

library to encrypt sensitive data using a defined secret key. This ensures that even if the data is intercepted, it remains unreadable without the key.

Decrypting Data with CAST-256-224 in JavaScript in Browser

The decryption process is just as crucial as encryption. Using the same

library, you can easily decrypt the data that was previously encrypted with CAST-256-224.

// Decrypt the data using CAST-256-224 (encryptedData, secretKey).

In this code snippet, the encrypted data is decrypted back to its original form, provided the correct secret key is used. It is essential to handle the keys securely to prevent unauthorized access to sensitive information.

CAST-256-224 comes with several strengths that make it an appealing choice for encryption:

: It is widely regarded as secure when implemented correctly, making it suitable for protecting sensitive data.

更多内容

除了上面提到的内容，还有几个点值得注意。首先是浏览器的兼容性，不同浏览器对Web Crypto API的支持程度有所不同。其次是性能问题，加密操作在大量数据时可能会影响用户体验。最后是密钥管理，如何安全地存储和传输密钥也是一个需要考虑的问题。

有问题欢迎评论区交流，看到会第一时间回复大家一起讨论。

Reference: CAST-256-224 Encryption : JavaScript in Browser - MojoAuth