阻止访问 JavaScript 文件
假设我有一个 JavaScript 文件...使用 .htaccess 有没有办法让用户无法查看 JavaScript 文件内部？
Let's say I have a JavaScript file... using .htaccess is there a way I can make it so a user can NOT look inside the JavaScript file?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
当所有 JavaScript 文件的引用者位于您的域之外时，这将返回 403 代码（禁止）。
注意：但此解决方案只会使文件访问变得更加困难。如果有人想查看该文件，他最终会这样做。因为你无法完全屏蔽js文件，如果浏览器可以读取它，用户也可以。示例：您只需打开开发工具即可看到源代码。或者，如果有人发现该块是由引用者发起的，他可以创建文件链接或使用其他方式将标头添加到请求中。
This will return 403 code (forbidden) when referer is outside your domain for all JavaScript files.
NOTE: But this solution will only make access to the file harder. If someone will want to see the file, he will do that eventually. Because you can't fully block the js files, if the browser can read it, the user also will. Example: you only can open dev tools and you will see the source. Or if someone will figure out that the block is by referrer he can create link to file or use other way to add the header to the request.
不。您可以对其进行混淆或将 JavaScript 隐藏在另一个容器中（例如内联在您的页面中），但不能阻止他们查看它。
如果你用 htaccess 文件阻止它，那么浏览器将无法下载并使用它，这使得拥有 javascript 文件变得毫无意义。一旦被浏览器下载，它就会位于本地计算机的缓存中，因此有决心/知识渊博的人可以找到它并检查它。如果你混淆它，你会让用户很难理解它，所以也许这是最好的选择。
No. You can obfuscate it or hide the javascript inside another container (like inline in your page), but not prevent them looking at it.
If you block it with your htaccess file, then the browser will not be able to download it and use it, which makes it pointless having the javascript file. Once downloaded by the browser it sits in the cache on the local machine, so a determined/knowledgeable person can find it and inspect it. If you obfuscate it you will make it very hard for the user to comprehend it, so maybe that is the best option.
让 JavaScript 或多或少“难以”阅读的唯一方法是对其进行压缩和混淆。
以下是一些解决方案：
The only way to make your javascript more-or-less "difficult" to read is by compressing and obfuscating it.
Here are some solutions:
您可以使用 http://dean.edwards.name/packer/
检查 < code>Base62 编码 和
收缩变量框使 JS 代码难以阅读。然后你就有了 Yahoo 压缩器：http://developer.yahoo.com/yui/compressor/
还有 Google 压缩器：http://code.google.com/closure/compiler/
第一个是在线的，最后两个需要在您的计算机上进行一些安装。
但是...由于浏览器需要理解它接收到的 javascript，耐心而坚定的人将能够对其进行逆向工程。但上面的压缩机会让很多人望而却步。
You can use http://dean.edwards.name/packer/
Check the
Base62 encodeandShrink variablesboxes to make the JS code hard to read.Then you have Yahoo compressor: http://developer.yahoo.com/yui/compressor/
And the Google compressor: http://code.google.com/closure/compiler/
The first one is on-line, the 2 last ones need some installation on your machine.
But... as the browser needs to understand the javascript it receives, a patient and decided person will be able to reverse engineer it. But the compressors above will discourage many of them.
这实在是一个毫无意义的练习。如果有人可以在您的网站上运行您的 Javascript，那么他就可以在他喜欢的任何其他地方运行它并进行任何他想要的更改。这在网络历史上还没有被证明是一个非常大的问题，所以我不会在上面浪费太多时间。
如果真的很担心有人会“窃取”你的 Javascript，那么版权就是你最好的武器。如果某些算法是秘密的，则在服务器上进行处理并只提供结果。
This is really a pointless exercise. If somebody can run your Javascript on your site, he can run it anywhere else he likes and make any changes he wants. This has not proven to be a very big problem in the history of the Web, so I wouldn't waste much time on it.
If it's really that big of a worry that somebody will "steal" your Javascript, copyright is your best weapon. If some algorithm is secret, do the processing on the server and just provide the result.
您无法真正保护您的 Javascript 文件
使用 Google Chrome 上的开发人员工具：
点击资源 >您的网站>脚本> filename.js
它将出现在水晶般清晰的地方。
You Can't Really Protect Your Javascript Files
Using Developer Tools on Google Chrome:
Click on Resources > Your Site > Scripts > filename.js
And it will appear right there Crystal Clear.