I’ve seen many discussions that suggest JavaScript obfuscation as a way to protect code. However, I’m concerned that this approach offers security through obscurity, which is not enough for my use case. Obfuscation may discourage casual copying, but it’s not suitable for protecting critical parts of a server-side application that includes paid or restricted features.

I’m building a Node.js backend application that will be installed on users’ computers and servers. This is not a front-end app, but a fully server-side application where some features need to be restricted or licensed. I need a more robust solution to ensure that specific sections of the code are secure and cannot be tampered with or accessed without proper authorization.

I’ve thought of a potential solution, but I’m not sure how effective or practical it is. Here’s the idea:

Use Webpack to bundle and obfuscate the JavaScript code into a single file (bundle.js).
Then, wrap the obfuscated bundle inside a C++ program. The C++ code would execute the JavaScript using Node.js by calling the command-line interface to run the obfuscated code:

#include <iostream>
#include <cstdlib>

int main() {
    // Obfuscated JavaScript code
    std::string jsCode = "obfuscated JavaScript code here";
    
    // Command to run JavaScript using Node.js
    std::string command = "node -e "" + jsCode + """;
    int result = system(command.c_str());

    if (result == 0) {
        std::cout << "JavaScript executed successfully!" << std::endl;
    } else {
        std::cout << "Failed to execute JavaScript!" << std::endl;
    }

    return 0;
}

By embedding the JavaScript inside a compiled C++ binary, I hope to add another layer of security, making it harder to reverse-engineer or tamper with the code. However, I’m not sure if this approach is practical, or if it’s a known method in the community.

• Has anyone explored this approach before? Is wrapping JavaScript inside a C++ binary a known technique for securing code, and if so, are there any best practices?
• Are there better ways to protect the code for paid or licensed features in server-side JavaScript applications, especially when those applications are deployed on systems I don’t control?
• Does this method have significant downsides such as performance issues or security vulnerabilities that I should consider before attempting it?
• Are there other established solutions for securing sensitive parts of a Node.js backend application that need to remain inaccessible unless properly licensed?

I’ve looked into tools like pkg and nexe, but these mostly package the application into an executable and don’t seem to offer strong protection for paid or restricted features. I’m looking for a solution that goes beyond security through obscurity.

In PHP, we used to have IonCube, it’s powerful and easy to set up. But now in JavaScript, people seem lazy to develop solutions like this, because most of the community thinks that obfuscation is enough. and this is because people used to write front-end applications and server-side apps that are not distributed. But now the era is evolving and you can write desktop apps with JavaScript as well as mobile apps.