- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
No JS obfuscator is worth the money and sweat to use them.
So, I'd say no, you can't really protect it, and don't bother spending cash on paid obfuscators (if you want to waste time, feel free to use the free ones out there, though they're barely worth your time too). Just use a good minifier / compressor / compiler to reduce the pay load. It will already make it harder to read, but not longer to run as will a lot of obfuscators. And it's still less readable to make it slightly more annoying to read and discourage some.
Also, when distributing a client, you're not really protecting yourself that much either. Disassemblers exist and knowledgeable software engineers who know how to use them are legion. Don't rely on obfuscation / obscurity for security, and don't consider a client a trade secret.
You could obfuscate the code, making it harder to understand, with a minifier such as the yui-compressor. Though its purpose is to compress the code so that the cost of bandwidth can be cut down or if you are concerned for having it load fast enough for your users.
By the way, don't worry, others will try to steal your site...
"Protected"? No. "Inconvenient"? Yes. (Just as with binary.)
At a certain level, no popular operating systems (yet) can prevent a sufficiently motivated actor from recovering the in-memory representation of your program and reverse-engineering it. So the "protection" is only relative to the value of your code to another.
If you need lots of security on your client side code then your doing something wrong. You should be doing your complex logic and validating inputs on the server side.
On a side note, its also worth mentioning that its also trivial in most languages to get from compiled code to human readable code. There are techniques to make it harder but none of them is perfect.
..because they can implement your app on their own server, and use your back-end resources to power their site. Many client-side apps store an appKey that gives them access to the backend. That's how the server knows it's an authorized client.
Worse, I don't want them to be able to modify my client-app, such that they can clone my site, and fool users into logging into my site, while also submitting the user's password to their own database as a harvesting mechanism.
Also, imagine I offer a free web app/service .. another site downloads the client-app, and modifies it such that they charge for access, handling billing/payment collection on their own server, but otherwise relying upon the API services on my server to provide the backend to their webApp offering (that I created).
At least with the code minified, it is unlikely that they can easily edit the client-app to charge people money, or clone my site and harvest passwords, etc.