Tell me more ×
Game Development Stack Exchange is a question and answer site for professional and independent game developers. It's 100% free, no registration required.
up vote 27 down vote favorite
13

I'm in the middle of planning a game built using JavaScript and HTML5.

I'm having trouble understanding how you could prevent someone from simply copying the JavaScript from the web server and either making their own game with it (not my biggest concern), or substituting their own JavaScript functions and dashing any hope for reliable clients in the wild if the game was to eventually support multiplayer.

Can anything be done to prevent just anybody from reading the JavaScript?

If not, should all game processing be taking place on a server somewhere with the client's only responsibilities being capturing user input and drawing graphics?

share|improve this question
19  
You're last paragraph reads about right, its true for business apps, and its true for games, always treat the client as hostle. – Nate Sep 9 '10 at 14:48
4  
If I can READ it, my browser already has a copy. Then I can also save it somewhere else. Anything you allow to be read, can also be copied. – BerggreenDK Nov 21 '10 at 2:36

9 Answers

up vote 32 down vote accepted

Keep all your game data and logics on the server. Part of the game which is on the client side can be copied using appropriate tools anyway (even if it's in Flash or Java), so just accept it and don't care too much about it.

To keep your javascript less copyable, because of bad readability, you can minify it. That's a good practice anyway as it makes the gaming site download faster.

share|improve this answer
4  
Depending on the coding practices, all of the content on the server can be compromised as well. To minify the code and obfuscate only deters those that do not want to take the time and logically map out what it is doing. Bottom line is, if your worried about the intellectual property rights of your code; don't put it on the web. – John Sep 9 '10 at 18:24
1  
That does not mean you should not minify, that deters the lazy people. You can also try processing your game logic on the server and return json objects through ajax, but the return can still be viewed with firebug. Obfuscate your production version but keep a heavily comment version for yourself (this makes it harder to maintain). You can do things to deter people, but it is never 100% safe. – John Sep 9 '10 at 18:31
3  
Indeed. Expanding minified code doesn't even take much effort. jsbeautifier.org – James Sep 10 '10 at 4:46
@John please notice sometimes deterring lazy people is irrelevant, since some games are ruined once a single cheater appears, so it's not relevant if only one or many are cheating. – Lohoris Mar 11 '12 at 12:02
up vote 9 down vote

how you could prevent someone from simply copying the JavaScript from the web server and either making their own game with it (not my biggest concern)

This is where the law helps. In practice this doesn't seem to happen very often.

or substituting their own JavaScript functions and dashing any hope for reliable clients in the wild if the game was to eventually support multiplayer.

There are no reliable clients in the wild, for exactly this sort of reason. Give up on this dream now. :)

share|improve this answer
The law is not going to be of much use when the site hosting it is in a country that does not care much about intellectual property rights, or is otherwise antagonistic to your country for whatever reason. Even when that's not the case, the cost of initiating a (potentially international) legal action is likely far beyond the financial resources of someone who would ask this question here. – Paul Legato Sep 26 '12 at 21:23
The intent of the answer was not so much to recommend legal action, but to suggest that trying to lock down such software is mostly pointless, at least in part because many of the people who would copy it are discouraged by law, but also because clients can be reverse engineered whether they use Javascript or not. – Kylotan Sep 26 '12 at 23:42
up vote 6 down vote

Just as everyone else has recommended; keep as much code as possible server-side.

A method I have used to deal with code copying is a bit odd, but it has worked well so far.

  • Server-side, generate unique id and store it for later.
  • Server-side, add unique id in script element during html rendering.
  • Client-side, create a WebSocket connection and pass the unique id to the server.
  • Server-side, match id against current list.
  • If match is not found, close connection.
  • If match is found, replace message handler with your "proper" one and discard id.
  • Stream your secret code to client as JSON, {"func":"function(){dostuff();}"}
  • Client-side, watch for messages, if they contain "func", eval it.

Now your secret code is executing client-side and won't show up in view-source or inspectors/consoles. There is still ways to get at the code, but it's quite a bit more difficult.

share|improve this answer
If I needed to grab something from the above solution; I would connect true WebSocket too and try to make a "fake client", or use a Firebug debugging tool in a browser and just stop the script to checkout the values. – BerggreenDK Nov 21 '10 at 2:40
You can't make a fake client unless you can somehow predict what unique ids are currently available, as they are generated at page load time and tossed at script connection time. Also, stopping the script and looking at the values is difficult, since you are eval'ing an anonymous function. Like I said, there are still ways to get at the code, it's just more difficult. For the most part, enough so that your code should be "safe enough". You can't do much more than that with client-side code. – Stephen Belanger Nov 21 '10 at 16:29
It'd be pretty easy to write a fake client that just loads the real client from the server and scrapes the current secret value from it each time it starts. – Paul Legato Sep 26 '12 at 21:25
I wouldn't say it's "easy" so much as "not impossible". As I said, there are ways around it. There's no such thing as a perfectly secure system. Just adequately obscured interfaces such that most will find it too much effort to hack. In this case, you'd be streaming bits of code, so a hacker would need to create a client to receive and arrange the code into a useful structure. You'd stream code as you need it, so the hacker wouldn't have immediate access to the full code dump. – Stephen Belanger Sep 26 '12 at 21:51
up vote 3 down vote

Aside from all this talk of code obfuscation, be sure to put a very clear copyright declaration at the top of each file and make it obvious that the license doesn't allow for alteration or commercial usage. This gives you legal recourse if someone does try to copy it. If you aren't willing to go to court over it, then this whole question is mostly academic.

share|improve this answer
This is fine for what it's worth, but that's not much. The concept of intellectual property is in practice not recognized in many countries, and in any case the legal costs of a court case are likely far beyond what a poster to this site has available, particularly if the attacker is in another country. – Paul Legato Sep 26 '12 at 21:27
up vote 2 down vote

The only way to be reasonably certain that your game code will be secure is to build a client/server type of game and put as much code as you can on the server. And of course, make that server secure!

The main issue is that if code is running on my computer, I can inspect it, decompile it, and figure out how it works. This is true for JavaScript, Flash, C++, anything else. In fact, in MMO development (which is where the bulk of my professional experience is) the assumption from the very beginning is that the client is compromised: whatever you have written for the client is already in the hands of whoever wants it, malicious or not.

Minifying code does provide a tiny amount of protection against people who are too lazy to unminify it using one of the many tools out there. (But production code should be minified to reduce its data footprint.)

But if you're in a situation where, say, your boss wants some kind of code protection, you can google "Javascript obfuscator" -- there's a lot of free and for-pay software out there that makes JS at least about as impervious to decompiling as Flash is.

share|improve this answer
up vote 0 down vote

I think if you make your game multi-player, which entails keeping your game logic in the server you would probably make it at least less appealing to steal. You can't trust the client really. As someone has already mentioned, there are tools for even compiled languages like Java and Flash, that can reverse engineer the text of the code from the byte code.

share|improve this answer
up vote -1 down vote

You need to use a Javascript Minifier. There are many options available feel free to find one that you like. To save you some research here's one you could try Yahoo Minifier. I haven't run that myself but I assume it will do what you need. The goal is to 1) reduce file size and 2) obfuscate code. This is accomplished by removing all whitespace, comments, and replacing variable names with shorter, nonsensical ones.

Most web applications today have a significant amount of Javascript and use tools such as these to try to protect their IP. As others have said you should always ask, "Can I do this on the server?" for important or sensitive operations, but I believe this should offer some protection.

share|improve this answer
6  
Security by obscurity obscures potential for security. :) – Rushyo Sep 10 '10 at 11:42
1  
Oh please. I hear this quote all the time but it's absolutely not true. Truth be told obscuring the JS would at least deter some people. – Sergio Oct 6 '10 at 17:24
1  
minifier doesnt help him. I believe most "serious" people knows how to "expand" those scripts again. – BerggreenDK Nov 21 '10 at 2:37
1  
@Sergio: you hear this quote all the time because, you know, it is true. It will deter "some" people, true, but deterring "some" people is pointless: when you're cracked once, you go down. – Lohoris Aug 2 '11 at 14:52
up vote -1 down vote

Use Google closure compiler http://code.google.com/closure/compiler/ It is not just a js minimizer ;)

What are the benefits of using Closure Compiler?

  1. Efficiency. The Closure Compiler reduces the size of your JavaScript files and makes them more efficient, helping your application to load faster and reducing your bandwidth needs.

  2. Code checking. The Closure Compiler provides warnings for illegal JavaScript and warnings for potentially dangerous operations, helping you to produce JavaScript that is less buggy and and easier to maintain.1.

share|improve this answer
up vote -2 down vote

Or you could use something like Game Maker HTML5 to create your game which will obfusicate the code for you. That means that it will make the code unreadable to humans. And it'll be near impossible to edit.

share|improve this answer
1  
-1 Obfuscation will only go so far. It certainly won't protect the game from being copied or altered - as has been mentioned on the other obfuscation answers to this question. – Jonathan Hobbs Oct 22 '12 at 15:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.