5

I have a requirement in which an Editor has to set some constant values in a JavaScript file placed on a Page, and those values should be encrypted to some extent.

In other words, it is required the values set for the JavaScript constants should not be visible in the Page's source in a human readable format.

I suggested to the client they encrypt the JavaScript code with a JavaScript Obfuscator first and then publish the encrypted code along with the Page.

I also suggested using a "Custom URL" to open this URL within the Tridion CME but they have not agreed on this solution.

Could somebody suggest me some other approaches to implement encryption of JavaScript constants added to Pages?

Improve this question
3
  • Are you looking for a better way on encrypt the values, instead of obfuscation? Bear in mind that however you encrypt, encode, or obfuscate a value in html or js source, can be decoded eventually, so can you clarify that, depending on what needs to be achieved? Or are you looking for the best way to post process fields in a Tridion Component? In that case, using the Tridion Event System seems the best solution, although you could also use the Anguilla framework with (or without) indeed a custom url to process values entered on fly. – Raimond Sep 5 '13 at 7:12
  • yes , i agree with you that html or js source, can be decoded eventually. Client have no concern on that and told to me that constants should not be available in the page view souce as they are. – user584 Sep 5 '13 at 8:09
  • 1
    I'm not really sure if this question is in the right place, is there really a relation to SDL Tridion in this question, or is your actual question more about encryption of JavaScript constants? (in which case it would be better asked on Stack Overflow) – Bart Koopman Sep 5 '13 at 8:38
5

The problem consists of 2 parts:

  1. Obfusicating the text published from Tridion
  2. Retreiving the text and unencoding it in JavaScript

Details: For the first part of the problem I would suggest writing a VBScript function or C# TBB method to accept a parameter of text and return the encoded version of that text. In your templates you will call the function or method. You probably first want to make sure the javascript framework / library is able to unencode it based on your approach.

Research best practices to encode / decode text with javascript applications. I am not too familiar with this, but am sure there are some standard approaches used here.

Alternatives:

  • Store the constants in the Broker as a JSON string or XML string and perform a Broker query from the web application to retrieve them. No obfusicating or encoding needed at this point.
  • Write a web service (ServiceStack if .Net) that returns the constants to the Web Application from the Broker database.
Improve this answer
2

Rather than trying to encrypt values in your JavaScript (which I understand you can do with something like JSAES), I would go for the option of using server side code.

If your SDL Tridion published Page is for example a ASPX or JSP page, then you can hide values from the source by placing them in the server side code. These values will only be available on the web/application server and never appear in the source client side.

But the big question would be, where are you using these constants for, if they are things like passwords which you need client side (in the JavaScript) then you need to have them available client side of course and server side code is of no use. But in that sense trying to "hide" the values by means of encryption is not going to be of any use anyways (it will be possible to decrypt so your security measure is just a fake).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.